GREF

GREF, a China-aligned Advanced Persistent Threat (APT) group, has been identified as the orchestrator of two active Android malware campaigns. The campaigns have been distributing a malicious software called BadBazaar via two applications, Signal Plus Messenger and FlyGram, through the Google Play store, Samsung Galaxy Store, alternative app stores, and dedicated websites. The campaigns have been ongoing since July 2023, with the threat actors exploiting open-source code from popular communication apps Signal and Telegram to create counterfeit versions which host the BadBazaar espionage tool. Significant code similarities have been found between the Signal Plus Messenger and FlyGram samples and the BadBazaar malware family, which Lookout attributes to the GREF cluster of APT15. This aligns with the targeting of other Android trojans previously used by GREF, including BadBazaar, SilkBean, DoubleAgent, CarbonSteal, and GoldenEagle. Furthermore, these campaigns are linked to the Chinese intelligence apparatus, which has operated under various names such as Winnti, PassCV, APT17, Axiom, LEAD, BARIUM, Wicked Panda, and GREF. The threat posed by the GREF APT group is significant, as evidenced by a recent Distributed Denial of Service (DDoS) attack described by Herman Gref, the CEO and chairman of the executive board of Sberbank, as the most powerful in their history. The cybersecurity company ESET identifies the threat actors behind the malicious tool as the China-aligned APT group GREF. These findings underscore the necessity for robust cybersecurity measures and vigilance against potential threats from sophisticated hacking groups like GREF.