Android spyware masquerading as a process manager app may have a possible link to the Russian hacking group Turla , advise Lab52 security researchers. The group has been designated an APT (Advanced Persistent Threat) maker which usually denotes a nation state or state-sponsored entity that lodges malware exploits in computer networks that are then able to lie dormant and send information to their creators for a long period of time.
- Access coarse location
- Access fine location
- Access network state
- Access WiFi state
- Camera
- Foreground service
- Internet
- Modify audio settings
- Read call log
- Read contacts
- Read external storage
- Write external storage
- Read phone state
- Read SMS
- Receive boot completed
- Record audio
- Send SMS
- Wake log
The reason that the Lab52 researchers indicate the process management app as weak threat despite its possible Turla connection, is that the persistent notification that the app is running is clearly visible, plus the app is part of a monetization infrastructure that hides in popular affiliate networks like the one linked to the popular Roz Dhan: Earn Wallet Cash app above.
That’s not a typical stealth behavior yet if you have installed some of those affiliate programs you can still look for the process manager app and revoke permissions or, better yet, uninstall them all if you are worried about your phone’s security.
