Monokle: Mobile Surveillanceware with a Russian Connection
summary
Covers a technical analysis of Monokle, a targeted Android surveillanceware, showing how it operates on mobile devices (including use of permissions and Android features like Accessibility services) and how investigators link its deployment and C2 infrastructure to a Russian government contractor. Explains deployment methods, network indicators (domains/IPs), and trends in advanced mobile surveillanceware development.
AI-written summary · about
chapters (32)
- 0:00Intro
- 2:37Special Technology Center (STC)
- 3:08Surveillanceware Prevalence
- 3:53Monokle-Agent
- 4:33Dates when Monokle samples were signed
- 5:24Observed samples
- 5:49Targets
- 6:14Detected Installations
- 6:25Malicious Functionality
- 6:48Android APIs
- 7:52Direct App Database Access
- 8:37Accessibility Service Usage
- 9:42Screen Unlock Recording
- 10:55Trusted Certificate Install
- 11:16Hooking using Xposed
- 11:42User-defined words for predictive text input
- 12:00C2 Communication (Outbound TCP)
- 12:56C2 Communication (SMS)
- 13:44Thrift - Defining Interfaces
- 14:23Thrift - Generating Code
- 14:34Evidence of iOS components - GetKeychain/SetKeychain
- 15:08Evidence of iOS components - Apns Registration
- 19:12Overlap in signing certificates for Monokle and STC's APKs
- 21:51Overlap in signing certificates with an STC employee's personal Android project
- 25:41Android Software Development Projects by STC
- 26:38Command and Control Infrastructure overlap
- 27:16Job Postings
- 27:54Developer, researcher ANDROID/IOS
- 32:44Indicators of Compromise
- 33:08Remediation and Forensic Options
- 34:27Mobile Surveillanceware Trends
- 36:46RS Conference 2020 San Francisco February 24-28 Moscone Center
related talks
32mUsing Geopolitical Conflicts for Threat Hunting
44mBeyond Desktops: The Rise and Transformation of Mobile Malware
42mIf 6,000 Mobile Malware Applications Could Talk! Ow, They Do, And A Lot!
30mReversing Mobile Malware
40mThe Canary in the Coalmine of Cybersecurity: Fraud as a Warning Sign
45mThe Discovery of a Government Malware and an Unexpected Spy Scandal
40mSecurity: The Hidden Cost of Android Stalkerware
44mBehind the Scenes: How Criminal Enterprises Pre-infect Millions of Mobile Devices