Cisco Talos Details How Intellexa’s ALIEN and PREDATOR Spyware Target Android
Summary
Cisco Talos analyzes Intellexa’s Android spyware components ALIEN and PREDATOR, describing how they work together to evade Android protections, execute code, record audio, and collect device data.
Key points
- ALIEN is more than a loader: it prepares privileged Android processes, communicates with PREDATOR, and executes commands that help bypass security restrictions.
- PREDATOR uses a Python-based modular design; the researchers assess that additional components, tcore and kmem, were not available for analysis.
- The spyware can inject code into processes, record microphone and call audio, collect contacts, messages and other device data, and exfiltrate it.
- ALIEN can hide selected apps, prevent them from starting after reboot, and add certificates to the user-trusted certificate store.
- The analyzed samples targeted Android devices; Talos assesses that the QUAILEGGS privilege-escalation method likely exploits CVE-2021-1048, but could not confirm the vulnerability from code.
- The report describes earlier exploit chains involving five 2021 zero-days used to deliver ALIEN, including vulnerabilities affecting Chrome, Linux, and Android.
Article Details
- Attack Vectors
- The article describes deployment through exploit chains that can exploit remote vulnerabilities to obtain code execution and escalate privileges. A prior delivery chain used five zero-day vulnerabilities to deliver ALIEN.
- The article also describes one-click delivery through a link that a victim is tricked into clicking.
- ALIEN is assessed to be injected into a privileged Android process. It downloads and launches PREDATOR, which can receive updated or additional Python-based modules.
- ALIEN and PREDATOR collect device files and information and support audio recording, including from calls and VOIP applications.
- Defensive Notes
- Talos advises people who suspect their systems may have been compromised by commercial spyware to notify its research team.
- Cisco says Secure Endpoint can prevent execution of the malware described, and lists other Cisco security products as protections for related activity.
MITRE ATT&CK
T1005 · Data from Local SystemALIEN enumerates device directories and reads local files containing contacts, calls, messages, configuration, and other device data.T1055.008 · Ptrace System CallsALIEN injects code into target-process memory using ptrace() and mmap().T1059.006 · PythonPREDATOR initializes a Python runtime and loads Python modules, including modules delivered as updates.T1105 · Ingress Tool TransferALIEN downloads the PREDATOR component and can download a replacement version.T1123 · Audio CaptureALIEN and PREDATOR support recording microphone, earpiece, voice-call, and VOIP audio.T1553.004 · Install Root CertificateThe spyware can add a CA public certificate to the current user's trusted certificate store, enabling TLS decryption in the browser.T1620 · Reflective Code LoadingALIEN loads an embedded DEX file into Android runtime using InMemoryClassLoader().
CVE
CVE-2021-1048The vulnerabilities, which were discovered in 2021, are CVE-2021-37973, CVE-2021-37976, CVE-2021-38000, CVE-2021-38003 — all of which affect Google Chrome, and CVE-2021-1048 in Linux and Android.CVE-2021-37973The vulnerabilities, which were discovered in 2021, are CVE-2021-37973, CVE-2021-37976, CVE-2021-38000, CVE-2021-38003 — all of which affect Google Chrome, and CVE-2021-1048 in Linux and Android.CVE-2021-37976The vulnerabilities, which were discovered in 2021, are CVE-2021-37973, CVE-2021-37976, CVE-2021-38000, CVE-2021-38003 — all of which affect Google Chrome, and CVE-2021-1048 in Linux and Android.CVE-2021-38000The vulnerabilities, which were discovered in 2021, are CVE-2021-37973, CVE-2021-37976, CVE-2021-38000, CVE-2021-38003 — all of which affect Google Chrome, and CVE-2021-1048 in Linux and Android.CVE-2021-38003The vulnerabilities, which were discovered in 2021, are CVE-2021-37973, CVE-2021-37976, CVE-2021-38000, CVE-2021-38003 — all of which affect Google Chrome, and CVE-2021-1048 in Linux and Android.
Malware
Vendors
Cytroxhas new details of a commercial spyware product sold by the spyware firm Intellexa (formerly known as Cytrox).IntellexaMercenary mayhem: A technical analysis of Intellexa's PREDATOR spywareNSO Groupservices seems to keep growing. Most commercial spyware is intended for government use, with firms like NSO Group advertising their products as technology that helps prevent terrorism, investigate crime, and enhance
Products
Androidwith it known as “ALIEN.” Both components work together to bypass traditional security features on the Android operating system.Google ChromeThe vulnerabilities, which were discovered in 2021, are CVE-2021-37973, CVE-2021-37976, CVE-2021-38000, CVE-2021-38003 — all of which affect Google Chrome, and CVE-2021-1048 in Linux and Android.iOSWhile ALIEN and PREDATOR can be used against Android and iOS mobile devices, the samples we analyzed were specifically designed for Android.SignalIt can also collect information from some of the most popular applications, including Signal, WhatsApp and Telegram.TelegramIt can also collect information from some of the most popular applications, including Signal, WhatsApp and Telegram.WhatsAppIt can also collect information from some of the most popular applications, including Signal, WhatsApp and Telegram.
Tools
xHookHooking the ioctl() API in the libbinder.so using an open-source library called xHook is one of the means it uses to communicate with PREDATOR.YAHFAand use that as an input for establishing hooks in Android runtime (ART) using a custom version of the YAHFA framework. The way that the hooking works is that ALIEN contains an embedded DEX file which is loaded