Two of the profiles were aimed at tech users while the other four posed as Kurd supporters. We reported these profiles to Facebook and they have all been taken down. We identified six Facebook profiles as part of this BladeHawk campaign, sharing these Android spying apps. Both campaigns were distributed via Facebook, using malware that was built with commercial, automated tools (888 RAT and SpyNote), with all samples of the malware using the same C&C servers. QiAnXin Threat Intelligence Center named the group behind these attacks BladeHawk, which we have adopted. The espionage activity reported here is directly connected to two publicly disclosed cases published in 2020. Both of them used alternative names to refer to the same Android RAT – LodaRAT and Gaza007 respectively. The newly discovered Android 888 RAT has been used by the Kasablanka group and by BladeHawk. Data from a download site indicates at least 1,481 downloads from URLs promoted in just a few Facebook posts. Some of the profiles deliberately spread additional spying apps to Facebook public groups with pro-Kurd content. These profiles appeared to be providing Android news in Kurdish, and news for the Kurds’ supporters. This campaign has been active since at least March 2020, distributing (via dedicated Facebook profiles) two Android backdoors known as 888 RAT and SpyNote, disguised as legitimate apps. ESET researchers have investigated a mobile espionage campaign that targets the Kurdish ethnic group and has been active since at least March 2020ĮSET researchers have investigated a targeted mobile espionage campaign against the Kurdish ethnic group.

Ringtone espionage