New Android Malware: Monokle and Other News

Malware Update: Monocle, A New Android Surveillance Tool

A new family of Android malware has been identified, called Monokle. This malware aims to exfiltrate sensitive information from victim devices, and also has the ability to conduct man-in-the-middle attacks against device traffic. Additionally, it can record the screen of an infected device. Although unsubstantiated, the organization who discovered this malware claims that this malware can be attributed to a Russian defense contractor.

Recommendations

• Enable multifactor authentication on mobile devices whenever possible
• Regularly update mobile devices and applications
• Consider enabling the Cyber Chatter rule in order to monitor this threat

Details

Researchers at Lookout have identified a new family of Android malware, that looks to conduct surveillance on victims. This malware contains functionality to exfiltrate data from an infected device as well as to conduct man-in-the-middle attacks by installing an attacker-specificed certificate as a trusted certificate on the device. The malware can also record the screen of an infected device, which also allows it access to a victim's phone lock code.

The research team at Lookout feels that there is enough evidence to link this malware to the Russian defense contractor, Special Technology Centre, Ltd. Although that have not published any of this information and ZeroFOX cannot verify the accuracy of the claims, Lookout claims that information in STC's antivirus solution conclusively links the Russian contractor to this malware family.

Breaking News - 07.25.2019

Three Romanian Men Sentenced in Phishing Campaign Trial

Three Romanian men have been sentenced by the Court of the Northern District of Georgia, for their role in phishing campaigns targeting a large financial institution. The trio compromised parts of the court system's servers between 2011 and 2014, and installed software to spam potential victims with spam calls and emails, as well as texts, seeking to gain sensitive financial information from victims.

See the full report here: https://info.phishlabs.com/blog/romanian-cybercriminals-sentenced-for-phishing-campaign

South African Infrastructure Hit in Ransomware attack

City Power, an electric company in Johannesburg, South Africa, has been stricken with a ransomware attack. The exact strain of malware is unknown, and systems are in the process of being restored. Critical infrastructure is an alluring target for attackers - especially given the age of most of these systems, and difficulties in patching them.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-attack-cripples-power-company-s-entire-network/

US Company Claims to Have Developed Working BlueKeep Exploit

Immunity Inc claims it has developed and released a working exploit for the RDP vulnerability BlueKeep, patched earlier this year. This exploit is available only through their paid penetration testing product, Canvas.

See the full report here: https://www.zdnet.com/article/us-company-selling-weaponized-bluekeep-exploit/