DragonEgg

DragonEgg is a malware associated with the notorious Chinese Advanced Persistent Threat (APT) group, APT41. This malicious software was developed to exploit and damage computer systems, often infiltrating through suspicious downloads, emails, or websites. The malware has been linked to surveillance activities targeting both Android and iOS users. It works in conjunction with another spyware, WyrmSpy, to compromise over 100 public and private sector organizations. Both DragonEgg and WyrmSpy were discovered in July 2023 by cybersecurity company Lookout, which also found that these tools share the same command-and-control (C2) infrastructure. The connection between DragonEgg and APT41 was further established through DNS searches and bulk WHOIS lookups for the DragonEgg indicators of compromise (IoCs). These investigations revealed that three out of four related domains were registered in China, where APT41 is based. Furthermore, cybersecurity firm ThreatFabric identified similarities between DragonEgg and LightSpy, an iPhone surveillance tool discovered in 2020. Both malware types use a trojanized Telegram app to deploy a second-stage payload prompting the installation of a "Core" module, capable of device fingerprint collection, remote server communication, and self-updating. ThreatFabric researchers concluded with high confidence that APT41 is responsible for using both the DragonEgg and LightSpy surveillance malware, given the similar configuration patterns, command-and-control server communications, and runtime structure and plugins. They also suggested that WyrmSpy, also known as AndroidControl, shares the same infrastructure as LightSpy and could be its successor. Therefore, DragonEgg represents a significant threat in the landscape of cyber espionage, particularly as it pertains to mobile devices, and is closely tied to the activities of state-sponsored threat operations like APT41.