Malicious Google Play Store Apps Used to Spy on North Korean Defectors

Individuals who escaped the territories of North Korea were targeted by malicious applications that were available on Google Play Store.

Reports have it that several apps made available on the Android digital distribution platform carried a malware that specifically targeted North Korean defectors. It was recently discovered by the cybersecurity company McAfee and was also found targeting journalists from the reclusive state.

The intrusive campaign was attributed to a hacker group that McAfee named the Sun Team and was characterized by injecting a spyware through installing malicious apps from the Play Store. In a recent blog, McAfee identified at least three apps, that were labeled “unreleased," to have been used in the surveillance. Two of the apps were marketed as an app locker while the other was disguised as a food-related software.

At the time of McAfee blog’s publication, the company revealed that the Sun Team hackers are “still actively trying to implant spyware on Korean victims’ devices.” Meanwhile, this particular report is the second surveillance campaign discovered to be perpetrated by the same group and had a very similar mode of operations.

The hidden spyware is activated once installed in an Android device. “Once the malware is installed, it copies sensitive information including personal photos, contacts, and SMS messages and sends them to the threat actors,” McAfee added.

Since the malware was discovered early, McAfee said the reported cases of surveillance through this campaign were relatively minimal and were only “about 100 infections from Google Play.”

Per McAfee’s research, the malware was in use last year. The hackers gather victims through a message campaign sent around via Facebook and with a “fake profile.”

It was found that the malware was able to remain active on Google Play for two months but was eventually taken down following detection. Naturally, Sun Team’s spyware was programmed to collect information and place it on cloud storage sites like Dropbox.

As always, smartphone users are advised to be very cautious when installing apps even if they are hosted on legitimate platforms such as the Play Store.