Badbazaar

BadBazaar is a malicious software, or malware, employed by EvilBamboo, a threat actor group. This malware is part of three Android spyware families developed by the group, including BADBAZAAR, BADSIGNAL, and BADSOLAR. These are custom-built to target adversaries of the Chinese Communist Party (CCP). The malware has been found hidden inside legitimate-looking applications like Signal and Telegram, making it particularly insidious. It has the capability to store SMS on the device, gather call logs, take photos, and collect information about the device such as IMEI, timezone, Wi-Fi details, installed apps, contact lists, and the device's location. BadBazaar first came into prominence in November 2022 when APT15 targeted the Uyghur community in China mainland and abroad, including Turkey and Afghanistan. The malware was disguised as Android mobile applications and distributed through the MOONSHINE app-based Android surveillance tooling. In addition to this, BadBazaar was also distributed through a site named allwhatsapp[.]net, which hosted variations of the malware. The same site appeared as the name of a likely malicious iOS app associated with BADSOLAR, and a Google account used to distribute the BADBAZAAR variant targeting Taiwanese individuals. The distribution of BadBazaar became more widespread in January 2023 when EvilBamboo started targeting Taiwanese users by distributing the Android spyware through threads on a Taiwanese APK sharing forum, apk[.]tw, which garnered over 100,000 views. Further analysis revealed that these applications were distributed among users with supporting Telegram groups. The advisory written by Volexity researchers shows that EvilBamboo primarily targets Taiwanese, Uyghurs, and Tibetan users through the distribution of these malware families.