Russia Creates Malware False-Flag App
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | cyberazov.com | ey hosted the app on a domain “spoofing” the Azov Regiment: cyberazov[.]com. […] The app actually didn’t DDoS anything, but was desig |
Full article191 words · extracted from schneier.com · click to collapse
The Russian hacking group Turla released an Android app that seems to aid Ukrainian hackers in their attacks against Russian networks. It’s actually malware, and provides information back to the Russians:
The hackers pretended to be a “community of free people around the world who are fighting russia’s aggression”—much like the IT Army. But the app they developed was actually malware. The hackers called it CyberAzov, in reference to the Azov Regiment or Battalion, a far-right group that has become part of Ukraine’s national guard. To add more credibility to the ruse they hosted the app on a domain “spoofing” the Azov Regiment: cyberazov[.]com.
[…]
The app actually didn’t DDoS anything, but was designed to map out and figure out who would want to use such an app to attack Russian websites, according to Huntely.
[…]
Google said the fake app wasn’t hosted on the Play Store, and that the number of installs “was miniscule.”
Details from Google’s Threat Analysis Group here.
Sidebar photo of Bruce Schneier by Joe MacInnis.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.schneier.com/blog/archives/2022/07/russia-creates-malware-false-flag-app.html