Unmasking State-Sponsored Mobile Surveillance Malware from Russia, China, and North Korea

An analysis of mobile surveillance malware used by state-sponsored threat actors from Russia, China, and North Korea.

Unmasking State-Sponsored Mobile Surveillance Malware from Russia, China, and North Korea – Threat Actors, Tactics, and Defense Strategies State-sponsored threat actors have expanded their arsenal of surveillance tooling, leaning into mobile malware as a way to acquire information about a target or target group that had otherwise been inaccessible through traditional desktop campaigns. With more than 86% of the worldwide population using a smartphone, attackers have access to the perfect espionage device in the pockets of nearly every potential target. However, APTs from various regions tend to conduct operations in significantly different ways. In this session, we'll explore the landscape of state-sponsored surveillance activity using case studies from Russian, Chinese and North Korean threat actors. We'll discuss their choice of targeting and the different methodologies each employ while introducing several previously unreported malware families that highlight the differences in these state-sponsored operations. By: Kristina Balaam | Senior Staff Security Intelligence Researcher, Lookout Kyle Schmittle | Senior Security Intelligence Researcher, Lookout Alemdar Islamoglu | Senior Staff Security Intelligence Researcher, Lookout Full Abstract and Presentation Materials: blackhat.com/eu-24/briefings/schedule/#unmasking-state-spons…