Ankura CTIX FLASH Update - September 12, 2023

Malware Activity

Malicious Telegram Apps Identified on the Google Play Store

Kaspersky has published information showing that several Telegram applications on the Google Play app store are malicious and still available to download. These trojan Telegram applications have been downloaded over 60,000 times by a targeted Chinese and Uyghur audience, as it appears the apps were tailored for these groups specifically. Although the fraudulent applications appear visually identical to the official Telegram application, they include additional packages that the original does not contain. Specifically, there are multiple calls to the "com.wsys" library that are attempting to gain access to a user's contact's information. This library also runs when connecting to a command-and-control (C2) server to facilitate the transfer of user information such as name and phone number. In addition, the trojan code contains a section called "uploadTextMessageToService" that reads