Kaspersky discovered an Android spyware campaign called LianSpy that targets Russian users. The malware can capture screencasts, exfiltrate files, and harvest call logs and app lists. It employs evasive tactics like using the Russian cloud service Yandex Disk for command and control communication, avoiding dedicated infrastructure, and utilizing robust encryption. Some features suggest LianSpy is likely deployed through an unknown vulnerability or physical device access. Author: AlienVault
Related Tags:
yandex
LianSpy
T1519
T1534
T1557
T1064
T1489
Russian Federation
T1518
Associated Indicators:
842D600D5E5ADB6CA425387F1616D6C4
3A4F780820043A8F855979D2C59F36F2
084206EC8E6E5684A5ACDCBD264D1A41
DA97092289B2A692789F7E322D7D5112
F13419565896C00F5E632346E5782BE4
C449003DE06BA5F092EE9A74A3C67E26
38149658E5ABA1942A6147B387F79D3F
09088DB5640381951E1B4449E930FF11
FA3FECCA077F0797E9223676D8A48391