Full Report
Discover how Zimperium can help with advanced spyware such as NoviSpy. The post How Zimperium Can Help With Advanced Spyware Such as NoviSpy appeared first on Zimperium.
Analysis Summary
# Tool/Technique: NoviSpy
## Overview
NoviSpy is a sophisticated Android spyware allegedly used by Serbian authorities (specifically the Security Information Agency or BIA) to monitor and suppress activists, journalists, and protesters. Its deployment often involves a multi-step process leveraging physical access to the target device.
## Technical Details
- Type: Malware (Spyware)
- Platform: Android
- Capabilities: Access sensitive data, activate device sensors, monitor communications.
- First Seen: Implied to be recent, linked to a 2024 Amnesty International report.
## MITRE ATT&CK Mapping
This summary focuses on the initial compromise vector and malicious post-installation actions:
- **TA0001 - Initial Access**
- T1566 - Phishing (Indirectly, as installation requires physical access which bypasses remote delivery)
- T1190 - Exploit Public-Facing Application (If the exploit chain involved a vulnerable app, though physical access is primary)
- **TA0003 - Persistence**
- T1543.003 - Create or Modify System Process: Systemd Service (Applicable if the spyware achieves persistence via system mechanisms, though not explicitly detailed)
- **TA0005 - Defense Evasion**
- T1562.001 - Impair Defenses: Disable or Modify Antivirus (Specifically disabling Google Play Protect)
- **TA0006 - Credential Access**
- T1552.001 - Credentials in Files (Accessing stored data)
- **TA0007 - Discovery**
- T1082 - System Information Discovery
- **TA0009 - Collection**
- T1560.001 - Archive via Utility
- T1056.001 - Input Capture: Keylogging (Implied by monitoring communications)
## Functionality
### Core Capabilities
- Covert installation following physical device manipulation.
- Access to sensitive data stored on the device.
### Advanced Features
- Ability to activate device sensors (e.g., microphone, camera) for surveillance.
- Monitoring of communications traffic.
- Reliance on initial steps like enabling Developer Mode and USB Debugging for deployment.
## Indicators of Compromise
*Note: Specific hashes or network indicators for NoviSpy were not provided in the text.*
- File Hashes: [Not provided]
- File Names: [Spyware application, details not specified]
- Registry Keys: [Not applicable for standard Android monitoring]
- Network Indicators: [Not provided]
- Behavioral Indicators:
- Enabling Developer Mode on the device.
- Activating USB Debugging.
- Disabling Google Play Protect.
- Preventing or disabling system security updates.
- Installation of sideloaded applications without user interaction.
## Associated Threat Actors
- Serbian Security Information Agency (BIA)
## Detection Methods
The text primarily suggests detection via Mobile Threat Defense (MTD) solutions:
- **Behavioral detection**: Monitoring system setting changes (Developer Mode activation, Play Protect status, USB Debugging enablement).
- **Machine Learning**: Analyzing application behavior and interactions for unknown malicious applications.
- **Configuration Monitoring**: Flagging changes to OS update settings.
## Mitigation Strategies
- **Physical Security**: Preventing unauthorized physical access to the device, especially during police stops or interrogations.
- **Device Hardening**: Never sharing device PIN/passcodes.
- **Security Configuration Maintenance**: Ensuring Google Play Protect remains enabled and automatic security updates are active.
- **Mobile Threat Defense (MTD)**: Deploying solutions like Zimperium MTD to monitor system integrity and detect unauthorized configuration changes and malicious application installations.
## Related Tools/Techniques
- **Cellebrite Forensic Extraction Tools**: Used to bypass screen locks (if the PIN is unavailable) and potentially facilitate the initial device manipulation necessary for installation.
- **ADB (Android Debug Bridge)**: Implied to be used for executing commands post-USB Debugging enablement.
***
# Tool/Technique: Cellebrite Forensic Extraction Tools
## Overview
Cellebrite forensic tools are proprietary technologies used for extracting data from mobile devices. Allegedly, Serbian authorities used these tools in conjunction with NoviSpy to bypass device locks and access contents.
## Technical Details
- Type: Tool (Forensic Extraction/Data Acquisition)
- Platform: Mobile Devices (Android/iOS)
- Capabilities: Bypassing screen locks, retrieving device contents, potentially facilitating the initial steps for malware installation.
- First Seen: Ongoing use, cited in 2024 report.
## MITRE ATT&CK Mapping
- **TA0010 - Collection**
- T1414 - Data Staged (Data extraction capabilities serve this purpose)
- **TA0002 - Execution**
- T1219 - Remote Access Software (Used in a highly controlled, physical context)
## Functionality
### Core Capabilities
- Forensic data extraction.
- Bypassing device lock screens (if PIN is inaccessible).
### Advanced Features
- Interfacing directly with device hardware/software to retrieve secure data.
## Indicators of Compromise
*Not applicable, as this is a legitimate commercial tool used maliciously.*
## Associated Threat Actors
- Serbian Security Information Agency (BIA)
## Detection Methods
Detection methods focus on detecting the *use* of the tool rather than the tool itself, such as monitoring for unauthorized device connection followed by known Cellebrite patterns, or integrating with security logs to monitor data extraction events.
## Mitigation Strategies
- Enforcing strict physical security protocols for devices.
- Using robust device encryption that is not susceptible to common forensic bypass methods.
## Related Tools/Techniques
- Other forensic tools (e.g., GrayKey, Magnet Axiom).