MITRE ATT&CKsoftware (malware)
S1195 SpyC23
- Domain
- mobile
- Platforms
- Android
- Version
- 1.0
- Created
- 2024-03-26
Description
SpyC23 is a mobile malware that has been used by APT-C-23 since at least 2017. SpyC23 has been observed primarily targeting Android devices in the Middle East.
There are multiple close variants of SpyC23, such as VAMP, GnatSpy, Desert Scorpion and FrozenCell, which add some additional functionality but are not significantly different from the original malware.
Related
Uses · MITRE ATT&CK (21)
- T1655.001 Match Legitimate Name or Location sub-technique
- T1628.002 User Evasion sub-technique
- T1644 Out of Band Data technique
- T1437.001 Web Protocols sub-technique
- T1629.003 Disable or Modify Tools sub-technique
- T1636.002 Call Log sub-technique
- T1636.003 Contact List sub-technique
- T1636.004 SMS Messages sub-technique
- T1624.001 Broadcast Receivers sub-technique
- T1628.001 Suppress Application Icon sub-technique
- T1633 Virtualization/Sandbox Evasion technique
- T1616 Call Control technique
- T1582 SMS Control technique
- T1544 Ingress Tool Transfer technique
- T1533 Data from Local System technique
- T1517 Access Notifications technique
- T1512 Video Capture technique
- T1513 Screen Capture technique
- T1406 Obfuscated Files or Information technique
- T1429 Audio Capture technique
- T1430 Location Tracking technique
Referenced by MITRE ATT&CK · uses (1)
- G1028 APT-C-23 group
References
- https://unit42.paloaltonetworks.com/unit42-targeted-attacks-middle-east-using-kasperagent-micropsia/ Unit42 VAMP 2017
- https://www.trendmicro.com/en_us/research/17/l/new-gnatspy-mobile-malware-family-discovered.html Trendmicro GnatSpy 2017
- https://web.archive.org/web/20201123042131/www.welivesecurity.com/2020/09/30/aptc23-group-evolves-its-android-spyware/ welivesecurity_apt-c-23