KoSpy
KoSpy is Android spyware active since at least March 2022, with the most recent samples acquired in March 2024. KoSpy has been distributed through Google Play and the third-party app store Apkpure and retrieves its configuration, including its C2 address, from Firebase Firestore. KoSpy has targeted Korean and English-speaking users and leverages infrastructure associated with APT37 and Kimsuky; however, it remains unclear whether either group has used KoSpy.[1]
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Mobile | T1437 | .001 | Application Layer Protocol: Web Protocols |
KoSpy has used an HTTP POST request with a payload in JSON format to obtain configuration data.[1] |
| Mobile | T1532 | Archive Collected Data |
KoSpy has encrypted collected data with a hardcoded AES key.[1] |
|
| Mobile | T1429 | Audio Capture |
KoSpy has recorded audio using dynamically loaded plugins.[1] |
|
| Mobile | T1476 | Deliver Malicious Application via Other Means |
KoSpy has been distributed via the third-party application store Apkpure.[1] |
|
| Mobile | T1420 | File and Directory Discovery |
KoSpy has accessed files and folders in the local storage using dynamically loaded plugins.[1] |
|
| Mobile | T1417 | .001 | Input Capture: Keylogging |
KoSpy has recorded keystrokes by abusing accessibility features.[1] |
| Mobile | T1430 | Location Tracking |
KoSpy has collected the device’s location using dynamically loaded plugins.[1] |
|
| Mobile | T1655 | .001 | Masquerading: Match Legitimate Name or Location |
KoSpy has masqueraded as legitimate applications, such as "File Manager, "Software Update Utility," and "Kakao Security."[1] |
| Mobile | T1406 | Obfuscated Files or Information |
KoSpy has encrypted and encoded values with Base64 during C2 communication initialization. |
|
| Mobile | T1636 | .002 | Protected User Data: Call Log |
KoSpy has collected call logs using dynamically loaded plugins.[1] |
| .004 | Protected User Data: SMS Messages |
KoSpy has collected SMS messages using dynamically loaded plugins.[1] |
||
| Mobile | T1513 | Screen Capture |
KoSpy has captured screenshots and recordings of the device screen using dynamically loaded plugins.[1] |
|
| Mobile | T1418 | Software Discovery |
KoSpy has collected a list of installed applications using dynamically loaded plugins.[1] |
|
| Mobile | T1422 | .002 | System Network Configuration Discovery: Wi-Fi Discovery |
KoSpy has collected Wi-Fi network details using dynamically loaded plugins.[1] |
| Mobile | T1512 | Video Capture |
KoSpy has taken pictures with the device’s cameras using dynamically loaded plugins.[1] |
|
| Mobile | T1633 | Virtualization/Sandbox Evasion |
KoSpy has checked if the device is not an emulator and if the current date is past the hardcoded activation date.[1] |
|
| Mobile | T1481 | .002 | Web Service: Bidirectional Communication |
KoSpy has used Firebase Firestore to receive configuration data: an "on"/"off" switch and the C2 server address.[1] |