Iranian Hackers Interested in Malware that Can Secretly Pull Data from Android Devices

Jeremy Kirk

October 29, 2015

Iranian hackers show strong interest in Android spying tools

Iranian hackers are showing strong interest in malware that can secretly pull data from Android devices, which are popular in the Middle East.

The analysis comes from Recorded Future, a cybersecurity intelligence firm based in Somerville, Massachusetts.

One of Recorded Future’s specialties is monitoring hacking forums, looking for clues and chatter that might indicate future attacks.

Over the last six months, there appears to have been high interest on Iranian hacking forums in remote access tools, or programs designed to listen to calls and collect text message and GPS data, according to a blog post.

The most-discussed tools were AndroRAT and DroidJack. AndroRAT is free and has been around for close to four years, while DroidJack appeared last year.

“With a low level of technical skill needed, open availability and strong community support on hacker forums, DroidJack and AndroRAT are likely to remain popular choices for threat actors seeking to take advantage of Middle Eastern mobile systems,” Recorded Future wrote.

The fact that Iranian hackers are embracing them now shows that threat actors are adapting to go after platforms that are popular in their own countries or regions, the company wrote. The tools to do so may be easy to get.

DroidJack has its own website. It costs US$210, and its developers aren’t cagey about the app’s mission: “DroidJack gives you the power to establish control over your beloveds’ Android devices with an easy-to-use GUI and all the features you need to monitor them.”

DroidJack can provide a list of calls made by a victim’s Android phone.

Tricking someone into installing such apps without their knowledge is illegal in most countries.

Symantec wrote in November 2014 that it found the names and phone numbers of people supposedly based in India who developed DroidJack.

AndroRAT has been an open-source project. Like DroidJack, it can be wrapped into a legitimate Android app’s application package (APK) in order to deceive people into installing it.

“The sustained Iranian interest in AndroRAT, despite its age and declining chatter from other sources, could be due to the easy download access, including GitHub repositories, and available community support for deploying the malware,” Recorded Future wrote.