Octagon is a multi-stage Android threat that impersonated the BH Alert emergency app to target users in Bahrain and deploy dynamically loaded DEX/JAR payloads. It abuses VPN, Accessibility, and AccountManager/Sync Adapter features to persist, capture credentials, intercept data, and communicate with a C2 server at 209[.]99[.]184[.]50:4444. #BHAlert #Octagon #com.kisa.octagonpanel #com.kit.kitty #ZfChs.dex #ZGdSEl.jar #alertbh.info
Keypoints
- Octagon is a layered Android threat that uses an initial dropper, dynamically loaded DEX and JAR payloads, and a child APK.
- The campaign primarily targeted users in Bahrain by impersonating the official BH Alert emergency application.
- The malware downloads a fake APK from phishing URLs and uses a misleading BH Alert/MyGov Bahrain-themed interface to trick victims.
- It extracts an encrypted asset, decrypts it with RC4, writes a DEX file to private storage, and loads it with DexClassLoader.
- Octagon abuses VPN permissions to intercept and redirect traffic while excluding selected apps to avoid suspicion.
- The child APK abuses Accessibility Service to capture lock-screen PINs, passwords, and unlock patterns, then stores them locally.
- It maintains persistence through fake account registration, periodic sync activity, shared preferences, and a configurable C2 infrastructure.
MITRE Techniques
- [T1204] Malicious File â The campaign starts by tricking victims into installing a fake app (âthe malware application âBH-Alert.apkâ downloaded from the phishing linkâ).
- [T1055.008] Process Injection: Dynamic Code Loading â The malware loads a decrypted DEX at runtime using DexClassLoader (âthe malware extracts an encrypted payload⌠and writes the resulting ZfChs.dex⌠dynamically loaded using DexClassLoaderâ).
- [T1543.003] Create or Modify System Process: Android Service â The app declares and uses services for malicious behavior (âdeclares multiple activities and services⌠loaded dynamically at runtimeâ).
- [T1136.001] Create Account: Local Account â The SyncHelper class registers a fake account to enable persistence (âabuses Androidâs AccountManager⌠by registering a fake account (OctagonPanel)â).
- [T1098.005] Additional Cloud Credentials â The app abuses account and sync infrastructure to maintain access (âregistering a fake account⌠enabling periodic synchronization every 30 minutesâ).
- [T1429] System Checks â The malware uses an allow list to reduce suspicion by exempting apps from VPN routing (âmaintains an allow list of applications⌠excluded from the VPN tunnelâ).
- [T1406] Hijack Execution Flow: Accessibility Services â The child APK abuses Accessibility Service to monitor lock screen input (âabuses Androidâs Accessibility Service to monitor lock screen eventsâ).
- [T1056.001] Keylogging â It captures PINs, passwords, and unlock patterns as victims type them (âcapture the victimâs PIN, password, and unlock patternâ).
- [T1115] Clipboard Data â Not mentioned.
- [T1001.003] Data Obfuscation: Steganography â The article notes encrypted payload handling but not steganography, so this technique is not applicable.
- [T1027] Obfuscated Files or Information â The malware stores and decrypts an encrypted payload to hide its functionality (âextracts an encrypted payload⌠decrypts it using an RC4-based routineâ).
- [T1090] Proxy: Internal Proxy â By setting up a malicious VPN tunnel, the malware intercepts and redirects traffic (âestablishes a malicious VPN tunnel to intercept and redirect all device trafficâ).
- [T1036] Masquerading â The app impersonates the BH Alert emergency service and uses a similar icon (âimpersonates the official BH Alert emergency serviceâ and âicon used is similar to the âMyGov â Bahrainâ appâ).
- [T1095] Non-Application Layer Protocol â No explicit non-application-layer protocol is described; not applicable.
- [T1071.001] Application Layer Protocol: Web Protocols â The phishing and payload download occur over web URLs (âdownload[.]alertbh[.]info/BH-Alert.apkâ).
- [T1041] Exfiltration Over C2 Channel â Stolen data is stored locally for later transmission to the command-and-control server (âpending responses awaiting transmission to the C2 serverâ).
- [T1090.002] Proxy: External Proxy â Not explicitly stated; the VPN tunnel is internal to the device and not an external proxy.
- [T1573] Encrypted Channel â The C2 configuration includes encryption passphrase and encrypted communication (âencryption passphraseâ and âEncrypted Communicationâ).
Indicators of Compromise
- [Package names ] malicious app and child APK identifiers â com.kit.kitty, com.kisa.octagonpanel
- [File names ] dropped or captured payloads and data files â BH-Alert.apk, ZfChs.ttf, ZfChs.dex, ZGdSEl.jar, captured_passwords.json, octagon_ward.db, octagon.xml
- [Hashes ] malware/package hashes listed in the report â 9694294addbe58be93ddbb6cabc499ce, 58330aaf1f533e9fe03b6355c60347b4, and 1 more hash
- [C2 address ] command-and-control endpoint used by the malware â 209[.]99[.]184[.]50:4444
- [URLs ] phishing and distribution links for the fake app â https://download[.]alertbh[.]info/BH-Alert.apk, https://bh-alert[.]com/assets/BH-Alert.apk, and https://playgoogle[.]bh-alert[.]com