FG Reports New Malware ‘ AbstractEmu ’ Attacking Android Phones

FG Reports New Malware ‘AbstractEmu’ Attacking Android Phones

The Nigerian Communications Commission (NCC) intends to alert telecom customers and the broader public to the discovery of a new Android virus.

Touchaheart Nigeria reports that Dr. Ikechukwu Adinde, NCC’s Director, Public Affairs, said this in a statement on Monday.

The malware, known as ‘AbstractEmu,’ has the ability to acquire access to cellphones, take entire control of affected smartphones, and surreptitiously adjust device settings while attempting to avoid detection.

The Nigerian Computer Emergency Response Team (ngCERT), a national agency established by the Federal Government to manage the risks of cyber threats in Nigeria, recently announced this discovery. ngCERT also coordinates incident response and mitigation strategies to proactively prevent cyber-attacks against Nigeria.

According to NCC, AbstractEmu is available on the Google Play Store, as well as third-party stores including Amazon Appstore and Samsung Galaxy Store, as well as lesser-known marketplaces like Aptoide and APKPure.

According to the advice, the rooting functionality of the virus was found in 19 Android apps that posed as utility apps and system tools such as password managers, money managers, app launchers, and data saving apps.

Third-party storefronts like Amazon Appstore and Samsung Galaxy Store, as well as lesser-known marketplaces like Aptoide and APKPure, are claimed to have been heavily used to distribute the programs.

All Passwords, Anti-ads Browser, Data Saver, Lite Launcher, My Phone, Night Light, and Phone Plus are just a few of the apps available. Rooting virus, despite its rarity, is extremely harmful, according to the report.

The threat actor can covertly grant itself hazardous rights or install further malware by utilizing the rooting procedure to acquire privileged access to the Android operating system — acts that would ordinarily need user engagement. With elevated privileges, the malware can also access sensitive data from other apps, which is impossible under normal conditions.

The ngCERT notice also detailed the risks of exposing their devices to the AbstractEmu attack. The attack chain is meant to use one of five exploits for older Android security issues to get root capabilities once it is deployed.

It also takes control of the device, installs other software, collects sensitive data, and sends it to a site controlled by the attacker. Furthermore, the malware can change phone settings to allow the app to reset the device password or lock the device through device admin; draw over other windows; install other packages; access accessibility services; ignore battery optimization; monitor notifications; capture screenshots; record device screen; disable Google Play Protect; and modify permissions that grant access to contacts, call logs, Short Messaging Service (SMS), and Geographic Positioning Service (GPS). While the malicious apps have been withdrawn from the Google Play Store, the ngCERT claims that they are still being distributed through other app shops.

As a result, in order to reduce the risks, the NCC wishes to reiterate a two-part ngCERT alert.

The two-fold advisory include:

1. Users should be wary of installing unknown or unusual apps, and look out for different behaviours as they use their phones.

2. Reset your phone to factory settings when there is suspicion of unusual behaviours in your phone.

The NCC will continue to sensitize and educate telecoms consumers on any cyber threat capable of inflicting low or high-impact harms on their devices, whether discovered through the ngCERT or the telecom sector’s Centre for Computer Security Incident Response, which is managed by the Commission, as part of its mandate and obligation to consumers.

In October 2021, the NCC warned telecom customers of a new, high-risk, and extremely harmful Android device-targeting Malware named Flubot, and provided instructions on how to prevent their devices from getting infected.