One of the main recommendations for protecting our mobile devices is to download all software through official stores, but sometimes a malicious element manages to introduce very well-camouflaged apps. That is exactly what happened with SonicSpy, a malware variant that began its activities in February of this year, providing users with "instant messengers" that can record audio, take photos, make calls, and extract contacts without any warning.
It is assumed that if a mobile device does not have root access enabled and gets its applications only from official stores, the chances of ending up with an infection are low. However, malware developers are not idle, and they always find a way to filter their creations through the cracks of each platform. Android has suffered the effects of this "arms race" on more than one occasion, and despite Google's good work, analyzing the behavior of thousands of applications entering the Play Store every day is a titanic task. This is where independent researchers step in, and we find things like SonicSpy, discovered by the people at Lookout.
SonicSpy began its deployment in February of this year, and available data suggests it was developed by an agent stationed in Iraq, although it is unclear whether it is governmental or private. More than a thousand applications have shown some kind of relation to SonicSpy, but the most important ones take the form of instant messengers. "Soniac" presents itself as a clone of Telegram, and on the surface it fulfills its basic functions without any issues. Lookout explains that the app actually has the ability to record audio, make calls, take photos, send text messages to numbers specified by the attacker, and extract details such as the contact list, history, and WiFi network settings.
In essence, applications with SonicSpy erase their traces by removing the icon from their launcher, and activate a remote connection with a server on port 2222. SonicSpy shares several technical elements with SpyNote, another malware whose initial reports date back to July 2016. In addition to Soniac, "Hulk Messenger" and "Troy Chat" made it to the Play Store, but once their link to SonicSpy was detected, they were quickly removed. In summary: it is no longer enough to restrict downloads to Google's store. Images, text, descriptions, and comments must be studied closely before downloading any app.
