New Infamous Chisel Malware Targets Android Users In State-Backed Campaign

Online, even more dangerous spyware targeting Android users has surfaced. The spyware, known as “Infamous Chisel,” is currently aimed at Ukrainian military Android users. While the effort currently appears to be primarily targeted at a country, it may develop into a more pervasive malware campaign.

CISA Warns Of New Infamous Chisel Android Malware

Through a recent advisory, the US CISA has cautioned Android users to be on the lookout for the recently found Infamous Chisel virus. The alert highlighted the specifically targeted malware, most likely from Russian threat actor group “Sandworm,” aiming at the Ukrainian military. It made reference to a joint malware analysis report from the US agencies (CISA, NSA, and FBI), as well as New Zealand’s National Cyber Security Centre (NCSC-NZ), the United Kingdom’s National Cyber Security Centre (NCSC-UK), Canada’s Centre for Cyber Security (CCCS), and Australia’s Signals Directorate (ASD).

When it comes to the malware, Infamous Chisel utilizes the Tor network to create a steadfast connection with the target devices. During this time, the malware gathers data from the device, including the list of installed apps, hunting specifically for software tailored to the Ukrainian military. Additionally, it demonstrates network surveillance capability and gives threat actors access to SSH. Additionally, it controls SCP file transfer, steals credentials from storage, locates users, gathers files, and exfiltrates communication data. Infamous Chisel includes a number of components that are detailed in the malware analysis report in order to manage all these activities.

The software lacks concealment, despite having substantial destructive capabilities, according to the experts. Therefore, it will be easier to detect the virus attack. However, as Android devices frequently do not have a host-based detection mechanism, the research speculates that the attackers may have purposefully chosen to disregard this feature. How the malware penetrates the target devices is currently a mystery. Currently, Infamous Chisel specifically targets the Ukrainian military, suggesting that it may be used as a new weapon in the ongoing confrontation between Ukraine and Russia. This specificity, however, may at any time be extended to cover other victims from various regions. To avoid such risks, all Android users must exercise caution when dealing with unwanted links or programs from unknown sources.