LianSpy underscores the ongoing evolution of mobile threats and highlights the importance of vigilance and robust cybersecurity measures
A new, previously undocumented Android spyware, named LianSpy, has been stealthily targeting users in Russia since at least 2021. Discovered by cybersecurity vendor Kaspersky in March 2024, LianSpy has been identified as a highly sophisticated post-compromise spyware, utilizing Yandex Cloud for command-and-control (C2) communications. This tactic allows the malware to evade detection by avoiding the need for dedicated infrastructure.
LianSpy disguises itself as legitimate apps, such as Alipay or an Android system service, and once activated, it checks whether it is running as a system app. If not, it requests a wide range of permissions to access contacts, call logs, and notifications, and can draw overlays on the screen. The spyware is also engineered to detect if it's operating in a debugging environment, allowing it to configure itself to persist across device reboots while hiding its icon and triggering malicious activities like taking screenshots and updating its configuration.
The malware also shows advanced stealth capabilities, bypassing Google's privacy indicators introduced in Android 12, which typically alert users when apps access the microphone or camera. LianSpy developers circumvent this protection by manipulating Android's secure setting parameters to suppress notification icons in the status bar.
LianSpy’s use of Yandex Cloud for C2 communications is particularly noteworthy. It searches for specific files on a threat actor's Yandex Disk every 30 seconds to update its configuration, downloading these files to its internal data directory when found. The stolen data is then stored in an encrypted SQL database, with only the threat actors able to decrypt the information using a corresponding private RSA key.
.webp)
.webp)
