In a recent discovery, cybersecurity experts have uncovered a previously undocumented Android spyware known as LianSpy, which has been targeting users in Russia since at least 2021. The malware was identified by Kaspersky, a leading cybersecurity vendor, in March 2024. LianSpy is notable for its use of Yandex Cloud, a Russian cloud service, to handle command-and-control (C2) communications. This clever tactic allows the spyware to avoid maintaining a dedicated infrastructure, making it harder to detect.

What Does LianSpy Do?

LianSpy is designed to operate in a highly covert manner. Once it compromises a device, it can capture screencasts, exfiltrate user files, and harvest call logs and app lists. The spyware's capabilities were detailed by Dmitry Kalinin, a security researcher, in a technical report published recently.

Interestingly, it’s still unclear how LianSpy is distributed. However, it is speculated that the malware could be deployed either through an unknown security flaw or direct physical access to the target phone. The malicious apps carrying LianSpy are often disguised as legitimate applications like Alipay or even an Android system service.

How Does LianSpy Operate?

Once activated, LianSpy checks if it's running as a system app, which allows it to operate in the background with administrator privileges. If not, it requests a broad range of permissions to access contacts, call logs, notifications, and more. It even overlays content on the screen, making it difficult for the user to notice anything amiss.

The spyware is sophisticated enough to detect if it's running in a debugging environment. It can then set up a persistent configuration that survives reboots, hides its icon from the launcher, and triggers activities such as taking screenshots, exfiltrating data, and updating its configuration based on the kind of information it needs to capture.

Some variants of LianSpy have been found to gather data from instant messaging apps popular in Russia. The malware also includes options to limit its activity based on network conditions, such as running only when connected to Wi-Fi or a mobile network.

Advanced Stealth Techniques

LianSpy is particularly adept at evading detection. It bypasses the privacy indicators feature introduced in Android 12, which requires apps requesting microphone and camera access to display a status bar icon. The developers of LianSpy have found a way to bypass this protection by modifying the Android secure setting parameter icon_blacklist, preventing the notification icons from appearing.

The spyware also hides notifications from background services by leveraging the NotificationListenerService, which processes status bar notifications and suppresses them.

Another layer of sophistication is added through the use of a modified su binary, renamed as "mu," to gain root access. This suggests that the spyware might be delivered through a previously unknown exploit or via physical access to the device.

The Bigger Picture

LianSpy’s stealthy nature is also evident in its unidirectional C2 communications, meaning the malware does not receive any incoming commands. Instead, it uses Yandex Disk to transmit stolen data and store configuration commands. The credentials for Yandex Disk are updated from a hard-coded Pastebin URL, which varies across different malware variants, adding another layer of obfuscation and making it difficult to trace the attackers.

This discovery adds LianSpy to the growing list of sophisticated spyware tools targeting mobile devices, both Android and iOS. These tools often exploit zero-day vulnerabilities to infiltrate devices.

LianSpy not only engages in standard espionage tactics like harvesting call logs and app lists but also leverages root privileges for covert screen recording and other evasive maneuvers. The use of a renamed su binary further indicates that LianSpy may be a secondary infection following an initial compromise.

As mobile devices continue to be a primary target for cybercriminals, it is crucial for users to remain vigilant and ensure their devices are protected with the latest security updates.