"WyrmSpy" and "DragonEgg," two spy bugs attributed to the Chinese threat group APT41, are targeting Android-based devices, according to researchers at Lookout, a mobile cybersecurity provider.
APT41, also known as Double Dragon, BARIUM and Winnti, is a state-sponsored espionage group that has been active since 2012. In August 2019 and August 2020, five of its hackers were charged by a federal grand jury in Washington, D.C. for a computer intrusion campaign that impacted dozens of companies in the United States and abroad.
The hacking crew is known for exploiting web-facing applications and infiltrating traditional endpoint devices. Lookout said that an “established threat actor like APT41 campaigning against mobile devices “shows how mobile endpoints are "high value targets” for work and personal information.
What We Know About the Spy Bugs
Threat discovery highlights include:
Kristina Balaam, Lookout senior threat researcher, explained how discovery of the malware shows the growing threat posed by “advanced” Android malware.
“These spyware packages are highly sophisticated and can be used to collect a wide range of data from infected devices. We urge Android users to be aware of the threat and to take steps to protect their devices, work and personal data.”
Protecting Your Organization
To protect your business and personal Android devices from WyrmSpy and DragonEgg, Lookout recommends the following:
