Malware from a Russian government hacking group disguised as a Ukrainian app. It is called “Cyber ​​Azov” (Cyber ​​Azov).

what is known

• Cyber ​​Azov is being developed by a group called Turla.
• According to the investigation, the application was distributed over a domain controlled by Turla and her team. had to install it manually from an APK fileInstead of downloading from the Google Play Store.
• The text on the site claimed that the program was allegedly designed to launch attacks on Russian resources, but analysis showed that the program was ineffective for this purpose.
• Many major anti-malware vendors label an app’s APK file as: Malware with Trojan horse.

Screenshot of the site distributing the malicious app / Photo by The Verge

It seems that the number of users installing the application is small. But the Cyber ​​Azov domain is still available. In addition, the website apparently listed a Bitcoin address for donations to the military – it didn’t take or take any action as per verification. Therefore, it can be said that the harmful campaign did not achieve its purpose.

It is worth noting that Cyber ​​Azov took advantage of a phenomenon that became very popular at the beginning of the full-scale Russian invasion of Ukraine. Since the spring, various services began to appear in the Ukrainian segment of the Internet, one after another, which allowed to participate in attacks on Russian services and companies’ websites. The user just had to open the site in the browser, and the user then used the computer’s resources to send the request. Thus, a large number of computers gathered in a single network, propaganda media, banks, social networks, state social services, etc. DDoS attacks have been carried out on resources.