Under the SEA - A Look at the Syrian Electronic Army's Mobile Tooling
summary
The Syrian Electronic Army builds and operates a custom Android surveillance family called SilverHawk (active since mid‑2016) that trojanizes WhatsApp/Telegram updates, fake Flash and Word apps, and watering‑hole installers to deliver remote audio/camera capture, file exfiltration and device info via a simple Hamza‑packet C2 protocol. Samples show a survival counter to hide battery use, PDB metadata tying handles (including an FBI‑listed alias), reuse of commodity RATs, and no zero‑day exploits.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 2:14Background Information
- 4:36SEA History
- 6:49SilverHawk
- 9:02Timestamps
- 10:28Capabilities
- 13:32Cracking
- 16:00Watering Hole Sites
- 17:51Phishing
- 21:51Personas
related talks
32mUsing Geopolitical Conflicts for Threat Hunting
56mCybersecurity & Privacy From The Global Lens
24mSyrian Electronic Army: Their Methods and Your Responses
26mThe Secret Life of Sandworms
49mEffects of Weaponized Malware on End-to-End Encryption and Exfiltrating Data from Signal Messenger
33mWhen Attackers Go Mobile-First with AI
30mReversing Mobile Malware
45mThe Discovery of a Government Malware and an Unexpected Spy Scandal