Baobeigou personal information protection today sharing:
malicious applications infiltrate contacts, text messages, phone recordings, and even chat information from applications such as Signal, Viber and Telegram.
ESET researchers discovered an active activity targeting Android users, conducted by the Bahamut APT Group. This activity has been active since January 2022, with malicious apps distributed through a fake SecureVPN website that only provides downloads of Android apps. Note that while the malware used throughout the campaign uses the name of SecureVPN, it has no association with legitimate multi-platform SecureVPN software and services.
1. The application used was a Trojan version of one of two legitimate VPN applications at different times, namely SoftVPN or OpenVPN, which were repackaged into Bahamut spyware codes, which the Bahamut group has used in the past.
2. It is possible to confirm that there are at least eight versions of these maliciously patched applications, and their code changes and updates are provided through the distribution website, which may mean that the activity is well maintained.
3. The main purpose of modifying the application is to extract sensitive user data and actively monitor the victim's message application.
4. We believe the goal is carefully selected because once Bahamut spyware is started, it will require an activation key before enabling VPN and spyware features. Both activation keys and website links may be sent to the target user.
5. We don’t know the original communication carrier (email, social media, messaging applications, text messages, etc.).
ESET researchers have discovered at least eight versions of Bahamut spyware. The malware is spread through a fake SecureVPN website as a Trojan version of two legitimate applications - SoftVPN and OpenVPN. These malicious applications have never been downloaded from Google Play.
This malware is able to penetrate sensitive data such as contacts, text messages, call history, device location and phone recording. It can also proactively monitor chat messages exchanged through very popular messaging applications, including Signal, Viber, WhatsApp, Telegram, and Facebook Messenger; data ooze is done through the malware's keyboard logging feature, which abuses accessibility services. The activity seems to be highly targeted, as no instances are seen in the telemetry data.
Bahamut Overview
Bahamut APT organizations usually target entities and individuals in Middle East and South Asia, with spear phishing information and fake applications as initial attack vectors. Bahamut specializes in cyber espionage, and we believe its goal is to steal sensitive information from victims. Bahamut is also known as an mercenary organization, providing hacker hiring services to a wide range of clients. The name was named by Bellingcat investigative news group for this threat actor who appears to be a phishing expert. Bellingcat named the organization after the huge fish floating in the vast Arabian Sea mentioned in the Fictional Book of Life written by Jorge Luis Borges. In Arab mythology, Bahamut is often described as an unimaginable giant fish.
In recent years, this group has become the subject of some publications, including:
2017-Bellingcat
2018-Talos
2018-Trend Technology
2020-Blackberry
2020--SonicWall
2021--Anti-Counterfeiting Hunter
2021--Cyble
2022--CoreSec360
2022--Cyble
2022--Cyble
Distribution Situation The initial fake SecureVPN application analyzed was uploaded to VirusTotal on 2022-03-17, from an IP address geo-located as Singapore, and there is also a link to a fake website, triggering one of our YARA rules.
At the same time, we received a notification about the same sample through @malwrhunterteam's DM on Twitter.
The malicious Android application used in this event was passed through the website theseecurevpn[.]com (see Figure 1), which uses the name of the legitimate SecureVPN service (in the domain name securevpn.com) -- but without any content or style.
(Figure 1. The fake SecureVPN website provides a Trojan download)
This fake SecureVPN website is created based on a free web template (see Figure 2), and it is likely to be used by threaters as a source of inspiration because it requires only minor changes and looks credible.
(Figure 2)
thesecurevpn[.]com was registered on 2022-01-27; however, the initial distribution time of the fake SecureVPN application is unknown. The malicious application is provided directly by the website and has never appeared in the Google Play Store.
Attribution Issue
Fake SecureVPN samples are seen in SecureChat activities recorded by Cyble and CoreSec360. We see that this code is only used in activities carried out by Bahamut; similarities to these activities include storing sensitive information in a local database before uploading it to the C&C server. The amount of data stored in these databases may depend on the activity. In Figure 3, you can see that this variant's malicious package class is compared to previous Bahamut code samples.
(Figure 3)
's previous malicious SecureChat package (left) and fake SecureVPN package (right) compared
with Figure 4 and 5. You can see that the SQL query of the early SecureChat malware (attributed to Bahamut) and fake SecureVPN malware has similarities.
(Figure 4. SQL query used in malicious code for early SecureChat activity)
(Figure 5. SQL query used in malicious code for fake SecureVPN activity)
Therefore, we believe that the fake SecureVPN application is related to the Bahamut group.
Analysis Report
Since the release website was launched, at least eight versions of Bahamut spyware are available for download. These versions are created by threat actors, with the fake application name followed by the version number. We were able to call out the following version from the server, and we believe that the version with the lowest version suffix provided to potential victims in the past, while recently, higher version numbers have been used.
(secureVPN_104.apk,SecureVPN_105.apk,SecureVPN_106.apk,SecureVPN_107.apk,SecureVPN_108.apk,SecureVPN_109.apk,SecureVPN_1010.apk,SecureVPN_1010b.apk)
We divide these versions into two branches because Bahamut's malicious code is placed in two different legitimate VPN applications.
In the first branch, from the versions secureVPN_104 to secureVPN_108, the malicious code is inserted into a legitimate SoftVPN application, can be found on Google Play, and uses the unique package name com.secure.vpn. As shown in Figure 6, the package name can also be seen in the PARENT_APPLICATION_ID value found in the version information found in the decompilation source code of the first forged SecureVPN application branch.
(Figure 6. Fake SecureVPN v1.0.4,
whose malicious code is included in SoftVPN as the parent application)
In the second branch, from the version secureVPN_109 to secureVPN_1010b, the malicious code is inserted into the legitimate open source application OpenVPN, which is found on Google Play, using the unique package name com.openvpn.secure. Like the Trojan SoftVPN branch, the package name of the original application can also be seen in the version information of the fake SecureVPN application, which is found in the decompiled source code, as shown in Figure 7.
(Figure 7. Fake SecureVPN v1.0.9 (SecureVPN_109))
its malicious code is contained in OpenVPN as its parent program, even if the hardcoded VERSION_NAME (1.0.0) does not change between different versions.
Apart from the split between these two branches, i.e. the same malicious code is implanted into two different VPN applications, other fake SecureVPN version updates only contain slight code changes or fixes, which does not make any significant difference considering its overall functionality.The reason why the
threater has moved from patching SoftVPN to OpenVPN as its parent app is unclear; however, we suspect the reason may be that the legitimate SoftVPN app has stopped working or is maintained and no longer able to create a VPN connection – as confirmed by our tests of the latest SoftVPN app from Google Play. This may be one reason Bahamut switches to OpenVPN, as potential victims may uninstall a VPN app that is not working from their devices. Swapping one parent application with another may require more time, resources and effort to successfully implement by threat actors. The malicious code packaged with the OpenVPN application is implemented one layer above the VPN code. The malicious code implements the spyware function, requiring the key to be activated, and then checks the provided key based on the attacker's C&C server. If the key is successfully entered, the server returns a token, which is required for successful communication between Bahamut spyware and its C&C server. If the key is incorrect, neither the Bahamut spyware nor the VPN feature will be enabled. Unfortunately, dynamic malware analysis sandbox may not mark it as a malicious application without the activation key.
In Figure 8, you can see an initial activation key request, in Figure 9, the network traffic behind this request and the response of the C&C server.
(Figure 8. Fake SecureVPN requires activation key before enabling VPN and spyware features)
(Figure 9. Fake SecureVPN activation request and response from its C&C server)
uses the activity of the fake SecureVPN application to try to keep a low profile because the URL of the website is likely to be passed to potential victims through activation keys, and such keys are not provided on the website. Unfortunately, we cannot get a valid key.
activation key layer does not belong to the original OpenVPN feature, and we do not recognize it as code from any other legitimate application. We believe it was developed by Bahamut because it also communicates with their C&C servers.
implements a layer of protection payload that is triggered immediately after being started on non-target user devices, or is triggered when analyzed, is not a unique feature. We have seen the Bahamut Group use similar protections in another event implemented in the SecureChat application analyzed by CoreSec360. This requires additional effort from the victims, they must create an account and log in, and then enable the functionality of the Bahamut spyware. We also observed that APT-C-23 is using similar protections, with potential victims requiring a valid coupon code to download malicious applications.
function
If Bahamut spyware is enabled, it can be remotely controlled by the Bahamut operator and can expose various sensitive device data, such as:
contact, text messages, call history, list of installed applications, device location, device account, device information (Internet connection type, IMEI, IP, SIM serial number), call history, and file list on external memory.
by abusing accessibility services, as shown in Figure 10, malware can steal notes from the SafeNotes application and actively monitor chat information and call information from popular messaging applications, such as:
imo-International Phone and Chat, Facebook Messenger, Viber, Signal Private Messenger, WhatsApp, Telegram, WeChat , and Conion application
(Figure 10. Fake SecureVPN request to manually enable accessibility services)
All oozing data is stored in a local database and sent to the C&C server. The features of Bahamut Spyware include the ability to update the application by receiving links to new versions from the C&C server.
summary
mobile activity operated by Bahamut APT Group remains active; it uses the same method to distribute its Android spyware application through websites that impersonate or masquerade as legitimate services, which has been seen in the past.Additionally, the code of spyware, and its functionality, is the same as previous activities, including collecting data to leak in a local database before sending it to the carrier's server, a strategy that is rare in mobile cyber spy applications.
seems to be keeping a low profile as we don't see any instances in the telemetry data. This may be achieved through highly targeted distributions, where potential victims are provided with a link to Bahamut spyware, which is required to enable malware's spy capabilities.
IoCs file
Network
MITRE ATT&CK technology
This table is created using the 11th edition of the ATT&CK framework.
Here is the sharing of Baobeigou’s personal information protection today. Baobeigou, the right to defend personal privacy forever.
