Love? Actually: Fake dating app used as lure in targeted spyware campaign in Pakistan

MITRE Techniques

• [T1398 ] Boot or Logon Initialization Scripts – GhostChat activates at device startup by receiving the BOOT_COMPLETED broadcast intent. (‘GhostChat receives the BOOT_COMPLETED broadcast intent to activate at device startup.’)
• [T1541 ] Foreground Persistence – GhostChat uses foreground persistence to keep a service running and maintain surveillance. (‘GhostChat uses foreground persistence to keep a service running.’)
• [T1426 ] System Information Discovery – GhostChat extracts device identifiers such as the device ID for profiling. (‘GhostChat can extract the device ID.’)
• [T1533 ] Data from Local System – GhostChat collects and exfiltrates files and other local data from the device. (‘GhostChat can exfiltrate files from a device.’)
• [T1636.003 ] Protected User Data: Contact List – GhostChat extracts the device’s contact list and uploads it to the C&C. (‘GhostChat can extract the device’s contact list.’)
• [T1437.001 ] Application Layer Protocol: Web Protocols – GhostChat communicates with its C&C over HTTPS to send harvested data. (‘GhostChat can communicate with the C&C using HTTPS requests.’)
• [T1646 ] Exfiltration Over C2 Channel – GhostChat exfiltrates harvested data to the operator via the C&C channel (HTTPS). (‘GhostChat exfiltrates data using HTTPS.’)
• [T1059.001 ] Command and Scripting Interpreter: PowerShell – The Windows DLL executes base64-encoded PowerShell commands delivered by the C&C, enabling remote code execution. (‘Windows agent can execute PowerShell commands received from the C&C server.’)
• [T1082 ] System Information Discovery – The Windows agent collects the computer name as part of its initial handshake with the C&C. (‘Windows agent collects the computer name.’)
• [T1033 ] System Owner/User Discovery – The Windows agent collects the username for identification when contacting the C&C. (‘Windows agent collects the username.’)
• [T1071.001 ] Application Layer Protocol: Web Protocols – The Windows agent uses HTTPS requests to communicate with its C&C server. (‘Windows agent can communicate with the C&C using HTTPS requests.’)
• [T1132.001 ] Data Encoding: Standard Encoding – The Windows agent receives base64-encoded PowerShell payloads from the C&C which it decodes and executes. (‘Windows agent receives base64 encoded PowerShell commands to execute.’)