Ukraine
Ukraine Cyberwar: Kremlin Android App
A false flag nasty according to Google’s Threat Analysis Group and a first for the perpetrators
The cyber war continues apace and Google has highlighted more activity by bad actors in Russia and Belarus. And now, Turla, (one of the threat groups associated with the Russian FSB) is pushing out Android malware.
The malware
Not on the Play Store
According to Google’s TAG (Threat Analysis Group), the alleged perpetrators — Turla — “recently hosted Android apps on a domain spoofing the Ukrainian Azov Regiment. This is the first known instance of Turla distributing Android-related malware. The apps were not distributed through the Google Play Store, but hosted on a domain controlled by the actor and disseminated via links on third party messaging services.”
It’s been labelled as CyberAzov.apk.
What it does
It spoofs an Azov Regiment domain (the right-wing-aligned Regiment is a crack Ukrainian army that was involved in defending Mariupol during the recent protracted Russian siege).
Users who download the app believe that when they use it they are participating in a DoS (denial of service) attack against Russian websites — they can even choose from a list of target websites.
Google says that a single ‘GET’ request is all that is sent to the target website selected by the user. And that’s not going to jam up the servers is it?
Why bother if that’s all it does?
Maybe that’s not all it does. VirusTotal collates security analysts’ data and currently show 27 different security organisations which flag it as malicious; it may well contain a Trojan to infect the Android device.
It could have been designed to flush out Ukrainian cyber-warriors, namely the large decentralized base of digital volunteers working online against Russia and labelled by Ukraine as the IT Army.
The impact
If ‘members’ of Ukraine’s IT Army are the target then the app is making very little progress. Google’s Billy Leonard writes that “We believe there was no major impact on Android users and that the number of installs was miniscule.”
I guess those guys in the IT Army are not stupid.
“All warfare is based on deception,” Sun Tzu wrote in The Art of War, just 25 centuries ago.
The blame
The blame is being laid at the keyboards of the Turla Group, a gang which is associated with FSB, the Russian Federal Security Service and has been responsible for many cyber attacks on Western organisations.
Turla is a Russian-based threat group that has infected victims in over 45 countries, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies since 2004. …Turla is known for conducting watering hole and spearphishing campaigns and leveraging in-house tools and malware
In addition
Google also noted that malware exploiting the Follina vulnerability is still active (associated with the Groups APT28 and Sandworm); also that Ghostwriter/UNC1151, a threat actor attributed to Belarus, has continued to target the accounts of webmail and social media networks of Polish users.
Join the IT Army of Ukraine and fight back?
Yes, you can.
The IT Army of Ukraine is a volunteer cyberwarfare organisation created at the end of February 2022 to fight against digital intrusion of Ukrainian information and cyberspace after the beginning of the Russian invasion of Ukraine on February 24, 2022
Here’s where:
Or you could actually donate a small drone to Ukraine at:
The face of ware is certainly changing.
About me: If you follow me I guarantee variety in your inbox with some peculiar perspectives! I write on a wide range of topics including humor, tech, space, geopolitics and travel, together with daily news events and the minutiae of my daily life living on a boat. Yes, I really do live on a boat (some readers don’t believe that). I also write, without apology, about…
…supporting Ukraine
If you appreciate stories like these and want to support other writers and me, consider signing up to become a Medium member. It’s only $5 a month, giving you unlimited access to incredible stories on Medium. If you sign up using my link below, I’ll earn a small commission at no extra cost to you.
Or maybe just buy me a coffee?
