CSE Malware ZLab – APT-C-27 ’s long-term espionage campaign in Syria is still ongoing

Researchers at CSE Cybsec ZLab analyzed a malicious code involved in a long-term espionage campaign in Syria attributed to a APT-C-27 group. A few days ago, the security researcher Lukas Stefanko from ESET discovered an open repository containing some Android applications.   The folder was found on a compromised website at the following URL: hxxp://chatsecurelite.uk[.]to […]

July 23, 2018

Researchers at CSE Cybsec ZLab analyzed a malicious code involved in a long-term espionage campaign in Syria attributed to a APT-C-27 group.

A few days ago, the security researcher Lukas Stefanko from ESET discovered an open repository containing some Android applications.

The folder was found on a compromised website at the following URL:

hxxp://chatsecurelite.uk[.]to

This website is written in Arabic language and translating its content it seems to offer a secure messaging app. The homepage shows how the application works and includes some slides about it.

Security researchers from CSE Cybsec Z-Lab analyzed the content of the folder and discovered an Android spyware that was developed to exfiltrate sensitive information from victims’ devices.

The malicious code was used to compromise entities in the area, the researchers discovered that it was part or the arsenal of a APT group tracked as APT-C-27, aka Golden Rat Organization.

The APT-C-27 group focused its activity in Syria in the last couple of years, it used both Windows and Android malware to compromise target devices. Its code was not so sophisticated, anyway, the activity of the group is still ongoing.

Searching online we have found only one team of researchers that tracked the activity of the APT-C-27 group in Syria since 2016, it was a group of researchers at 360 Threat Intelligence Center.

The analysis published by the team revealed the activity of the APT-C-27 in Syria, the code analyzed by malware analysts at Zlab at CSE Cybsec and the one dissected by 360 Threat Intelligence Center is quite identical.

The 360 Threat Intelligence Center is dated 2017, the experts at CSE Cybsec collected evidence that the cyber espionage is still ongoing and that the threat actor continues to improve its malicious code.

Further details on the malware samples analyzed by CSE Cybsec, including the IoCs and Yara Rules are available in the report published by researchers at ZLAb.

You can download the full ZLAB Malware Analysis Report at the following URL:

http://csecybsec.com/download/zlab/20180723_CSE_APT27_Syria_v1.pdf