Lookout unmasks state-sponsored Android spyware tied to India-Pakistan conflict
Lookout, Inc., provider of mobile security solutions, announced the discovery of two novel Android surveillanceware, Hornbill and SunBird. The Lookout Threat Intelligence team believes these campaigns are connected to the Confucius APT, a well-known pro-India state-sponsored advanced persistent threat group. Hornbill and SunBird have sophisticated capabilities to exfiltrate SMS message content, encrypted messaging app content, geolocation, contact information, call logs, as well as file and directory listings. The surveillanceware targets personnel linked to Pakistan’s military and nuclear authorities and Indian election officials in Kashmir.
The Confucius group was previously reported to have first leveraged mobile malware in 2017 with ChatSpy[1]. However, based on this new discovery, Lookout researchers found that Confucius may have been spying on mobile users for up to a year prior to ChatSpy with SunBird. SunBird campaigns were first detected by Lookout researchers in 2017 but no longer seem to be active. The APT’s latest malware, Hornbill, is still actively in use and Lookout researchers have observed new samples as recently as December 2020.