On 31 August 2023, the National Cyber Security Centre (NCSC), alongside international partners, published a report on a malware campaign targeting Android mobile devices used by the Ukrainian military.
The malware, referred to as ‘Infamous Chisel’, has been used by the Russian cyber threat group known as Sandworm. NCSC has previously attributed Sandworm to the Russian General Staff Main Intelligence Directorate’s (GRU) Main Centre for Special Technologies (GTsST).
Infamous Chisel enables persistent access to, and the collation and exfiltration of data from, compromised Android devices. This includes targeting applications used by the Ukrainian military.
Infamous Chisel has highly likely been used with the aim of stealing sensitive military information. This activity demonstrates Russia’s continued use of cyber capabilities to support the invasion of Ukraine.
It would be really interesting how they distribute the malware.
Without prodiving details sounds like propaganda piece.
Russians doing this bad thing but we don’t really tell you how or any defense tricks…
The defense is to keep your device locked down and don’t click on sketchy shit. There’s not much point in trying to publish an exhaustive list of known bad links & email attachments, as that list would be obsolete within moments of its release.
They should examine if GrapheneOS would work for their needs. A lot less attack surface as far as Android phones go.
Edit: Probably a good idea to avoid Telegram as well in favor of better platforms and apps like Signal, Matrix, etc. Not sure where Telegram is run from but I don’t trust them
Here are the gory details for any who are interested: https://media.defense.gov/2023/Aug/31/2003292099/-1/-1/0/INFAMOUS_CHISEL_20230831.PDF