Forest Global Training Partners

Cyber Risks · Cisco Talos

Starry Addax targets human rights defenders in North Africa with new malware

Summary: Cisco Talos analyzed an Android APK called "FlexStarling" that masquerades as the Sahara Press Service app, serving Spanish-language content from the SPSRASD website while deploying additional malware components and stealing data from infected devices. The campaign, attributed to Starry Addax, begins with Arabic-language spear-phishing emails from the attacker-owned domain ondroid[.]site targeting human rights activists in Morocco and the Western Sahara, and uses a Firebase-based command-and-control channel with custom-built components rather than commodity spyware.

What you should know: Talos assesses the campaign is in its nascent stages, with infrastructure and additional malware variants still in development, and the implant requests permissions including READ_SMS, READ_CALL_LOG, READ_CONTACTS and RECORD_AUDIO while checking for emulators and analysis tools before running. The targets are named individuals - human rights defenders in Morocco and Western Sahara - and the malware is built to sit quietly on the device for an extended period.

Read the original at Cisco Talos ↗

Topics
Malware
Related