John Paul M. Joaquin Tech 04.01.2022 22:Apr PM EDT

Newly Found Tracking Malware on Android May Be of Russian Origin

Invasive Russian malware, specifically spyware masquerading as an Android app, was recently detected by cybersecurity researchers at Lab52.

According to the researchers' report, the spyware is linked to the Russian state-backed hacking group, Turla, known for using custom malware to target European and American systems for espionage, per Bleeping Computer.

The Google App Store no longer hosts the app in question for download as of the publication of this article.

Turla Spyware Details

According to Lab52's report, a warning appears informing an Android user about the permissions granted to the application. These include screen unlock attempts, locking the screen, setting the device global proxy, setting screen lock password expiration, setting storage encryption, and disabling cameras. Giving the app permissions will delete the app's icon from the screen and notify the user that it is running in the background.

The suspected Russian spyware requires different permissions from the user, but the Process manager app itself will request the user to permit it to access 18 phone features. These are:

Access coarse location
Access fine location
Access network state
Access Wifi state
Camera
Foreground service
Internet
Modify audio settings
Read call log
Read contacts
Read external storage
Write external storage
Read phone state
Read SMS
Receive boot completed
Record audio
Send SMS
Wake log

The spyware also allows itself to be added to the phone's backup, share info with other apps and be accessed by the device, and access secret content.

Bleeping Computer noted that these permissions, when granted, pose a critical risk to a user's privacy as it allows the app to track the device's location, send and read texts, and access the phone storage. The permissions will also let the hackers take pictures with the camera without the user knowing and record audio.

It also speculated that the spyware is part of a larger system based on its command and control server infrastructure, per Android Police.

It remains to be seen what implications a Russian connection to the malware entails.

How to Get Rid of Spyware and Malware

Android users must review app permissions already granted and revoke those that appear to expose them to privacy invasion and hacking, among other things.

Avast also suggests using a spyware removal tool to remove hidden spies and remove all traces of them from people's Android devices. Although these tools come with antivirus apps, many of them may be fake apps and could even be malware or other spyware in disguise.

Deleting suspicious apps can also save users from avoidable headaches in the future, per AVG. To do so, users should reboot their Android phones in safe mode to prevent third-party apps from running. After doing so, they should go to "Settings" and tap "Apps & Notifications" to access the info of the apps installed on the device. Tapping "Uninstall" on any app that looks suspicious will remove the troublesome app and spyware.

Performing a factory reset is the last resort for compromised users as it wipes everything the phone has, including the spyware. Before doing so, Avast strongly suggests these people have a backup made before the spyware issues started happening to prevent loss of photos, apps, and other important data on the device.

Tags Malware Russian Malware Russian Android malware Turla hacking group Turla Turla malware Turla Android malware Spyware Russian spyware Russian android spyware Process Manager malware Process Manager spyware Turla Process Manager