The suspected Pakistani group Transparent Tribe is known for targeting the military, diplomats, and now the Indian education sector.
While outside the Play Store, they distribute weaponized Android apps via self-run sites and social engineering tactics.
The cybersecurity researchers at Sentinel Labs recently reported that the threat actors behind this group are actively exploiting the CapraRAT Android malware to hijack Android devices by mimicking the YouTube app.
The organization has been employing the malware CapraRAT, which hides RAT functionalities within programs, since 2018. Threat actors utilized it to monitor Pakistani human rights activists and Kashmir-related issues.
However, besides this, the group disguised CapraRAT as a dating app for several illicit and spyware activities in early 2023.
An APK connects to a YouTube channel owned by Piya Sharma, borrowing her name and likeness, indicating the group’s continued use of romance-based social engineering.
CapraRAT offers data harvesting and exfiltration capabilities with the following notable features:-
Attend the Live DDoS Website & API Attack Simulation webinar to gain knowledge on various types of attacks and how to prevent them.
CapraRAT, initially dubbed by Trend Micro, was found to bear hints of AndroRAT in its Android APK distribution.
Researchers identified several YouTube-themed CapraRAT APKs and analyzed three samples among them. Here below we have mentioned them:-
On launch, CapraRAT’s MainActivity loads YouTube in a WebView, offering a distinct user experience compared to the native Android app.
CapraRAT exhibits varying file structures in different apps since it’s a versatile Android framework. The following files were found when the security analysts analyzed all three CapraRAT APKs:-
MainActivity drives core features, enabling persistence via Autostarter in the onCreate method. It initializes mTCPService as TPSClient and schedules an alarm to run every minute.
The RAT’s key activity, TPSClient, resembles Extra_Class, which contains over 10,000 lines of Smali code. TPSClient handles CapraRAT commands through a run method, with switch statements linking commands to methods.
The notable changes include the hideApp method’s behavior based on the Android version and config settings, possibly due to OS changes post-Android 9.
CapraRAT’s config file stores the C2 server as SERVERIP and port values in hexadecimal Big Endian format, converting to port 14862, 18892, and 10284 for specific APKs.
Here below, we have mentioned all the recommended security measures:-
Keep informed about the latest Cyber Security News by following us on Google News, Linkedin, Twitter, and Facebook.
CISA has released a comprehensive cybersecurity advisory detailing how threat actors successfully compromised a U.S.…
Google has issued an urgent security update for its Chrome web browser to address three…
Cybersecurity professionals are facing an unprecedented acceleration in threat actor capabilities as the average breakout…
A sophisticated malware campaign has emerged in the npm ecosystem, utilizing an innovative steganographic technique…
Zloader, a sophisticated Zeus-based modular trojan that first emerged in 2015, has undergone a significant…
A sophisticated malware campaign has emerged that leverages fake online speed test applications to deploy…