Ankura CTIX FLASH Update - July 21, 2023

Malware Activity

Two Spyware Variants "WyrmSpy" and "DragonEgg" Recently Attributed to China-Linked Threat Group APT41

Researchers have attributed two (2) new Android spyware variants to the China-linked advanced persistent (APT) group APT41 (otherwise known as Winnti, Wicked Panda, and BARIUM). APT41 has been active since 2012 and historically targeted both public and private organizations, such as "nation-state governments, software development companies, computer hardware manufacturers, telecommunications providers, social media companies, and video game companies," with the goal of financial gain as well as espionage. Researchers noted that it is rare for APT41 to be exploiting mobile platforms, as the group typically exploits web-facing applications and traditional endpoint devices. APT41 has been linked to two (2) Android spyware variants, "WyrmSpy" and "DragonEgg", which are detailed by researchers as having sophisticated data collection and exfiltration