Acronis Details Android Spyware Campaign Masquerading as Israel’s Red Alert App
Summary
Acronis says a smishing campaign targeting Israeli users delivered a trojanized Red Alert Android app that preserved alerts while harvesting SMS, contacts, location, accounts and installed apps. Researchers assess a possible link to Arid Viper.
Key points
- Acronis TRU identified SMS messages impersonating Home Front Command/Oref Alert and using shortened links to distribute a trojanized Android APK.
- The package com.red.alertx loads an embedded copy of the legitimate alert app, preserving its functionality while spyware runs in the background.
- The loader hooks Android’s package manager and alters runtime fields to spoof the app’s signature and make it appear installed from Google Play.
- The spyware collects SMS, contacts, location and device accounts, and enumerates installed apps; it can use location to conditionally trigger behavior.
- Collected data is sent to hxxps://api[.]ra-backup[.]com/analytics/submit[.]php. Acronis says the endpoint returned 404 during analysis and may be gated or taken down.
- Acronis assesses a possible connection to Arid Viper (APT-C-23) based on targeting, tooling and operational patterns, while noting these indicators are not unique to the group.
- Acronis recommends avoiding APKs delivered by SMS, reviewing app permissions, auditing potentially affected devices, and blocking the reported C2 infrastructure.
Article Details
- Attack Vectors
- Smishing messages spoofed Home Front Command/Oref Alert sender IDs and used bit.ly links to direct Israeli recipients to a trojanized Red Alert APK.
- The APK sideloaded a spyware component while extracting and running the legitimate app from an embedded asset to preserve alert functionality.
- The malware used a dynamic proxy to forge app-signature information and spoof the installer as Google Play.
- After permissions were granted, the spyware collected SMS messages, contacts, location, device accounts, and installed-app data, then exfiltrated it to its C2.
- Defensive Notes
- Install apps only from official sources; do not sideload APKs from SMS links or shortened URLs.
- Treat urgent SMS messages requesting app updates through shortened links as suspicious and verify the sender independently.
- Review permissions: the article says the legitimate Red Alert app only requires notification access; requests for SMS, contacts, location, or overlay permissions are suspicious.
- Audit potentially compromised devices for package com.red.alertx. The article recommends a factory reset for confirmed infections because components may remain after standard removal.
- Block ra-backup[.]com and api[.]ra-backup[.]com, including the reported C2 endpoint, in DNS, firewall, proxy, and EDR controls.
- On affected devices, rotate passwords and revoke active sessions for accounts that may have been exposed.
- Keep Google Play Protect enabled and report suspicious SMS messages to CERT-IL and relevant national authorities.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | ra-backup[.]com | Campaign C2 domain; the article reports it was registered in 2025 for the campaign. |
| HOSTNAME | api[.]ra-backup[.]com | C2 host serving the reported data-exfiltration endpoint. |
| SHA256 | 83651b0589665b112687f0858bfe2832ca317ba75e700c91ac34025ee6578b72 | SHA256 of the trojanized RedAlert.apk spyware sample analyzed in the campaign. |
| URL | hxxps[:]//api[.]ra-backup[.]com/analytics/submit[.]php | Hardcoded C2 exfiltration endpoint used by the spyware to transmit harvested data. |
MITRE ATT&CK
T1406The malware obfuscated strings with Base64 and XOR encryption and randomized class and method names.T1418The spyware enumerated installed applications and sent the results to its server in batches.T1426The spyware used reflection to invoke AccountManager methods and retrieve device accounts.T1430The spyware retrieved GPS location and used proximity to a configured area to conditionally trigger behavior.T1437.001The malware communicated with its C2 over HTTPS at the reported api[.]ra-backup[.]com endpoint.T1624.001The article reports that RECEIVE_BOOT_COMPLETED lets the malware relaunch after a device reboot.T1632.001A dynamic proxy modified package-manager responses to forge signature information and spoof Google Play as the installer.T1636.001The malware used AccountManager to retrieve accounts registered on the device.T1636.003After contacts permission was granted, the malware queried contact entries, phone numbers, and email addresses.T1636.004After SMS permission was granted, the malware queried the SMS database for messages.T1646The article reports continuous exfiltration of harvested SMS, contacts, location, accounts, and installed-app data to the C2.T1660The campaign used spoofed Home Front Command SMS messages with shortened links to deliver the trojanized APK.
Threat Actors
APT-C-23The article identifies APT-C-23 as another name for Arid Viper and assesses a possible, unconfirmed link between the group and this campaign.Arid ViperAcronis assesses that the campaign might be linked to Arid Viper based on targeting, tooling, and operational patterns; the article says the indicators are not unique and the link is possible, not confirmed.
Products
AndroidAcronis TRU uncovered a targeted smishing campaign delivering a trojanized Red Alert Android app to Israeli users via SMS impersonating Home Front Command, preserving legitimate alert functionality while running hiddenGoogle Play ProtectEnable Google Play Protect and keep it active.Red Alert — Israelapplication mimics the legitimate Red Alert — Israel (צ××¢