BTC $65266.0064
ETH $3170.2759
BNB $579.9567
SOL $151.5810
stETH $3170.3792
XRP $0.5307
DOGE $0.1622
TON $6.2152
ADA $0.5047
AVAX $37.5087
wstETH $3690.1011
WBTC $65350.8728
DOT $7.1858
WETH $3168.2550
TRX $0.1112
BCH $512.3933
LINK $14.9136
MATIC $0.7262
ICP $15.2978
UNI $7.8248
LTC $85.1449
DAI $1.0008
RNDR $9.1190
CAKE $2.9399
IMX $2.1935
STX $2.8650
ETC $27.9082
FDUSD $0.9998
MNT $1.2003
NEAR $6.3271
FIL $6.6129
OKB $55.7832
HBAR $0.0909
TAO $475.1056
VET $0.0423
WIF $3.0785
ATOM $8.6865
MKR $3070.6157
KAS $0.1185
FET $2.4759
GRT $0.2860
INJ $29.1371
PEPE $0.0000
USDE $0.9998
XLM $0.1150
THETA $2.2569
XMR $121.6010
BTC $65266.0064
ETH $3170.2759
BNB $579.9567
SOL $151.5810
stETH $3170.3792
XRP $0.5307
DOGE $0.1622
TON $6.2152
ADA $0.5047
AVAX $37.5087
wstETH $3690.1011
WBTC $65350.8728
DOT $7.1858
WETH $3168.2550
TRX $0.1112
BCH $512.3933
LINK $14.9136
MATIC $0.7262
ICP $15.2978
UNI $7.8248
LTC $85.1449
DAI $1.0008
RNDR $9.1190
CAKE $2.9399
IMX $2.1935
STX $2.8650
ETC $27.9082
FDUSD $0.9998
MNT $1.2003
NEAR $6.3271
FIL $6.6129
OKB $55.7832
HBAR $0.0909
TAO $475.1056
VET $0.0423
WIF $3.0785
ATOM $8.6865
MKR $3070.6157
KAS $0.1185
FET $2.4759
GRT $0.2860
INJ $29.1371
PEPE $0.0000
USDE $0.9998
XLM $0.1150
THETA $2.2569
XMR $121.6010
  • Catalog
  • Blog
  • Tor Relay
  • Jabber
  • One-Time notes
  • Temp Email
  • What is TOR?
  • We are in tor
  • Iranian Android malware BouldSpy is actively used for cyber espionage purposes

    Mobile cybersecurity firm Lookout recently analyzed a piece of Android spyware allegedly used by the Iranian government to monitor minority groups in the country and track arms, alcohol and drug trafficking. Dubbed BouldSpy, the malware was likely installed by Iranian law enforcement using direct physical access to the victims' devices, allegedly obtained during their detention.

    The investigated spyware has been in use since at least 2020. To date, more than 300 victims have been identified. The data obtained during the study also indicate the potential use of the BouldSpy program to combat and monitor human trafficking. However, even despite the good intentions of law enforcement officers, their actions can hardly be called legal.

    The malware control panel allows Iranian operators to control victims' mobile devices, and the application itself can take on the appearance of any popular application while maintaining its full functionality.

    “Given the likelihood of physical installation as the starting vector for BouldSpy, it is likely that BouldSpy victims already had legitimate versions of these applications installed. And when their devices were confiscated, these applications were trojanized to avoid accidental discovery by the victim,” Lookout researchers note.

    On infected devices, BouldSpy may collect credentials, a list of installed applications, browser data, call logs, clipboard contents, contact lists, device information, a list of files and folders, and SMS messages.

    The malware also allows operators to record phone calls, take photos with the phone's camera, log keystrokes, locate the device, record audio, and take screenshots. In addition, BouldSpy can record victims' voice calls through various Voice over VoIP applications common within Iran.

    BouldSpy performs its malicious activities in the background by abusing Android accessibility services. The spyware also disables smart power saving to prevent the device from ending the BouldSpy process. But even if this happens, the malware will definitely start again after the smartphone is rebooted, as it is registered in the system autorun.

    Spyware can receive C2 commands via web traffic and via SMS messages. Although it encrypts files for exfiltration, the C2 traffic itself is not encrypted in any way, which allowed the researchers to detect and intercept it.

    BouldSpy also contains ransomware code borrowed from the CryDroid open source project, but Lookout believes that this code is currently not used in any way.

    Author DeepWeb
    Tor Project and ProtonMail call on governments around the world to stop weakening encryption on the Internet
    White Phoenix: A powerful decryptor that recovers data from ransomware attacks

    Comments 0

    Add comment