Starry Addax Uses FlexStarling Android Malware to Target Human Rights Activists in North Africa
Summary
Cisco Talos details Starry Addax phishing campaigns targeting human rights activists linked to the Sahrawi cause with Android malware that can steal data and deploy components, and Windows credential-harvesting pages.
Key points
- Spear-phishing emails direct targets to attacker-controlled links that deliver the FlexStarling Android app or redirect Windows users to credential-harvesting pages.
- Targets include human rights activists in Morocco and Western Sahara, particularly people associated with the Sahrawi Arab Democratic Republic cause.
- FlexStarling masquerades as a Sahara Press Service app and can collect device data, access files, and upload files to attacker-controlled Dropbox folders.
- The malware uses anti-emulation checks and receives commands from a Firebase-based command-and-control server.
- Talos says the campaign appears to be in an early stage, with custom-built malware and infrastructure indicating a focus on stealth.
- Talos published file hashes and network indicators and outlined Cisco security products that can detect or block the activity.
Article Details
- Attack Vectors
- Spear-phishing emails direct targets to install a malicious Android application, FlexStarling, or to a website that serves the APK.
- For Windows users, the website redirects to credential-harvesting pages masquerading as social media or popular media login pages.
- FlexStarling receives commands from a Firebase-based C2, including commands to download files, delete files, decrypt and load DEX files, and upload local files to Dropbox.
- Defensive Notes
- Cisco Talos recommends using Cisco Secure Endpoint, Cisco Secure Web Appliance, Cisco Secure Email, Cisco Secure Firewall, Cisco Secure Malware Analytics, and Umbrella to detect or block the reported malware, emails, websites, and network activity.
- Cisco Duo provides multi-factor authentication; Talos also points to current Snort Subscriber Rule Set updates.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | ondroid[.]site | Attacker-owned domain used to send phishing emails and direct targets to malicious infrastructure. |
| DOMAIN | ondroid[.]store | Attacker-controlled domain hosting links that serve FlexStarling or redirect victims to credential-harvesting pages. |
| SHA256 | ec2f2944f29b19ffd7a1bb80ec3a98889ddf1c097130db6f30ad28c8bf9501b3 | Malware hash listed in the article's IOCs. |
| SHA256 | f7d9c4c7da6082f1498d41958b54d7aeffd0c674aab26db93309e88ca17c826c | Malware hash listed in the article's IOCs. |
MITRE ATT&CK
T1005 · Data from Local SystemFlexStarling can read local files and upload a specified file from the infected device.T1056.003 · Web Portal CaptureWindows targets are redirected to login pages that harvest credentials.T1566.002 · Spearphishing LinkStarry Addax sends spear-phishing emails containing links that lead targets to malicious websites.T1567.002 · Exfiltration to Cloud StorageFlexStarling can upload local files to attacker-designated Dropbox folders using the Dropbox API.
Threat Actors
Malware
Vendors
Products
Adaptive Security ApplianceNext-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat. AndroidStarry Addax conducts phishing attacks tricking their targets into installing malicious Android applications we’re calling “FlexStarling.” Cisco Duo Cisco Duo provides multi-factor authentication for users to ensure only those authorized are accessing your network. Cisco Secure EmailCisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign. You can try Secure Email for free here. Cisco Secure EndpointCisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here. Cisco Secure FirewallCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with thisCisco Secure Malware AnalyticsCisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products. Cisco Secure Web ApplianceCisco Secure Web Appliance web scanning prevents access to malicious websites and detects malware used in these attacks. DropboxUpload a local file to the attacker’s dropbox folders using the Dropbox API. Firebasea heavy focus on stealth and conducting activities under the radar. The use of FlexStarling with a Firebase-based C2 instead of commodity malware or commercially available spyware indicates the threat actor isFirewall Management CenterAdditional protections with context to your specific environment and threat data are available from the Firewall Management Center. Meraki MXFirewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat. Microsoft WindowsFor Windows-based targets, Starry Addax will serve credential-harvesting pages masquerading as login pages from popular media websites. Snort Subscriber Rule Set Open-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org. Threat Defense VirtualCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with thisUmbrellaUmbrella, Cisco's secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs and URLs, whether users are on or off the corporate network. Sign up for a free trial of Umbrella here.