Full Report
Discover how Zimperium can help with advanced spyware such as NoviSpy. The post How Zimperium Can Help With Advanced Spyware Such as NoviSpy appeared first on Zimperium.
Analysis Summary
# Tool/Technique: NoviSpy
## Overview
NoviSpy is a sophisticated Android spyware allegedly used by Serbian authorities (specifically the Serbian Security Information Agency - BIA) to monitor and suppress activists, journalists, and protesters. Its deployment often relies on initial physical access to the target's device.
## Technical Details
- Type: Malware family (Spyware)
- Platform: Android
- Capabilities: Access sensitive data, activate device sensors, monitor communications, installation via sideloading/physical access infiltration.
- First Seen: Implied to be recently operational based on the Amnesty International report.
## MITRE ATT&CK Mapping
The techniques described relate heavily to initial access via physical means and subsequent configuration tampering on the device.
- T1078 - Valid Accounts (Implied, if credentials like a PIN are coerced/stolen)
- T1552 - Credentials Access (If PIN is obtained/bypassed)
- T1189 - Drive-by Compromise (Less likely; installation relies on physical access)
- T1203 - Exploitation for Client Execution (If an exploit is used to facilitate setup)
- T1566.001 - Phishing: Spearphishing Attachment (Not detailed, but common precursor to installation)
- T1558.003 - Steal or Compromise Credentials: Credentials from Web Browsers (Potential goal of the spyware)
- T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (Likely implemented via configuration changes on Android)
*(Specific installation steps cover Device Configuration changes which map to broader areas of persistence and defense evasion.)*
## Functionality
### Core Capabilities
- Installation covertly once physical access is gained.
- Data exfiltration capabilities targeting sensitive information.
- Sensor activation (e.g., microphone/camera monitoring).
- Communication monitoring.
### Advanced Features
- Deep integration/manipulation of Android system settings to maintain persistence and evade detection (e.g., disabling security features).
- Potential use in conjunction with forensic tools like Cellebrite for initial device access bypass.
## Indicators of Compromise
- File Hashes: [Not provided in the text]
- File Names: [NoviSpy application file (sideloaded)]
- Registry Keys: [N/A - Android OS/Configuration Keys only]
- Network Indicators: [C2 infrastructure details not provided in the text]
- Behavioral Indicators:
- Activation of Developer Mode.
- Enabling of USB Debugging.
- Disabling of Google Play Protect.
- Disabling of automatic system updates.
- Installation of unauthorized sideloaded applications.
## Associated Threat Actors
- Serbian Security Information Agency (BIA)
## Detection Methods
(Methods provided rely on Mobile Threat Defense solutions like Zimperium MTD)
- Signature-based detection: [Not explicitly detailed for NoviSpy specifically, detection relies on behavior]
- Behavioral detection:
- Monitoring system settings for unauthorized changes (Developer Mode activation).
- Continuous tracking of Google Play Protect status.
- Detection of active USB Debugging connections.
- Flagging changes to OS update settings.
- Identification of unauthorized sideloaded applications.
- Using Machine Learning to analyze app behavior against OS interactions for unknown malicious applications.
## Mitigation Strategies
- Employ robust Mobile Threat Defense (MTD) solutions for real-time detection and protection.
- Implement strict physical security policies to prevent unauthorized physical access to devices, especially during stops or interrogations.
- Ensure mobile devices are configured to prevent enabling Developer Mode or USB Debugging without explicit authorization.
- Regularly verify that Google Play Protect remains enabled.
- Ensure automatic security updates are active and cannot be easily disabled.
## Related Tools/Techniques
- Cellebrite forensic extraction tools (Used as part of the initial breach vector).
- General Android mobile spyware techniques, focusing on configuration tampering for persistence.
***
# Tool/Technique: Cellebrite Forensic Extraction Tools
## Overview
Cellebrite forensic technology is allegedly used by Serbian authorities to bypass Android lock screens and retrieve device contents, often in conjunction with the deployment of NoviSpy.
## Technical Details
- Type: Tool (Forensic Extraction/Data Recovery)
- Platform: Mobile Devices (Android/iOS implied)
- Capabilities: Bypassing device lock screens, extracting device contents, often utilized during physical access scenarios.
- First Seen: N/A (Commercial tool capabilities)
## MITRE ATT&CK Mapping
The usage described focuses primarily on initial access through bypassing authentication.
- T1078 - Valid Accounts (If PIN is obtained/coerced)
- T1105 - Ingress Tool Transfer (Tool usage itself is often external)
- T1003.001 - OS Credential Dumping: LSASS Memory (Data extraction capabilities)
- T1552.001 - Unsecured Credentials: Credentials in Files (Data extraction capabilities)
## Functionality
### Core Capabilities
- Bypassing screen locks (PIN/Pattern).
- Forensic extraction and dumping of sensitive data from the mobile device filesystem.
### Advanced Features
- Forensic-grade access potentially bypassing standard security controls designed to prevent unauthorized access.
## Indicators of Compromise
- File Hashes: [N/A - Related to the tool itself, not the compromise artifact]
- File Names: [N/A]
- Registry Keys: [N/A]
- Network Indicators: [N/A]
- Behavioral Indicators: Use of specialized hardware/software interfaces to connect to the target device in a forensic mode.
## Associated Threat Actors
- Serbian Security Information Agency (BIA)
- Law enforcement and intelligence agencies globally (Standard users of Cellebrite solutions).
## Detection Methods
- Detection is difficult as it hinges on device access protocols. MTD platforms would detect the subsequent system changes enabled by the unlocked device, rather than the unlocking process itself.
## Mitigation Strategies
- Strong, complex device passcodes/PINs that are difficult to brute-force or guess.
- Utilizing device encryption settings.
- Monitoring for physical tampering or unauthorized connection attempts post-interrogation.
## Related Tools/Techniques
- Physical device compromise techniques.
- Other commercial or open-source forensic tools capable of data extraction.
***
# Technique: Physical Access Installation/Manipulation Chain
## Overview
The attack relies on gaining physical access to the target's device, often during police stops or interrogations, to manually configure the phone’s settings and install the NoviSpy spyware.
## Technical Details
- Type: Technique (Initial Access & Configuration Tampering)
- Platform: Android
- Capabilities: Enables covert installation and configuration changes bypassing remote defenses.
- First Seen: Continuously relevant in targeted physical intrusions.
## MITRE ATT&CK Mapping
This chain maps significantly to Initial Access via Physical Compromise and subsequent Defense Evasion/Persistence actions.
- T1189 - Drive-by Compromise (Not applicable, this is manual physical intrusion)
- **T1198 - Outer Endpoint Compromise (Physical access)**
- T1548.002 - Bypass User Account Control (Manipulating security settings requires elevated access)
- T1548.003 - Bypass Security Settings (Disabling Play Protect/Updates)
- T1562.001 - Disable or Modify Tools: Windows Management Instrumentation (Configuration modification on Android)
## Functionality
### Core Capabilities
1. **Gaining Access:** Obtaining physical possession or control over the unlocked device (via Cellebrite or stolen PIN).
2. **Configuration:** Enabling Developer Mode and USB Debugging to allow external control (ADB).
3. **Defense Disabling:** Turning off Google Play Protect and blocking system updates.
4. **Deployment:** Sideloading and installing the final malicious payload (NoviSpy).
### Advanced Features
- Systematic, step-by-step manipulation of OS settings specifically designed to create a persistent, high-privilege environment for the malware.
## Indicators of Compromise
- Behavioral Indicators: Sequence of system configuration changes (Dev Mode ON -> USB Debugging ON -> Play Protect OFF -> Updates disabled).
- File activity indicating sideloading of unauthorized APKs.
## Associated Threat Actors
- Serbian Security Information Agency (BIA)
## Detection Methods
- MTD solutions monitoring device state changes in real-time.
- Detection of the specific sequence of configuration changes.
## Mitigation Strategies
- Device encryption and strong PINs.
- Mobile Device Management (MDM) policies preventing Developer Mode, USB Debugging, and disabling security features.
- Regular security auditing of device configurations.
## Related Tools/Techniques
- Use of ADB commands (facilitated by enabling USB Debugging).
- Use of Forensic tools (Cellebrite) to facilitate initial access.