A sophisticated Android malware known as DocSwap, linked to a North Korean-backed Advanced Persistent Threat (APT) group, has been identified as part of the puNK group, specifically tracked as puNK-004. The discovery comes amid increasing efforts by Google to combat malicious Android applications, with over 2.36 million harmful apps blocked in 2024 alone.
The malware poses as a “Document Viewing Authentication App” (문서열람 인증 앱), primarily targeting mobile device users in South Korea, where the government is currently implementing a nationwide mobile ID card system. Upon execution, DocSwap decrypts an internal “security.db” file using an XOR operation and dynamically loads a DEX file to enable malicious activities including keylogging and information theft.
First detected on December 13, 2024, the malware prompts users to grant various permissions, including accessibility services for keylogging capabilities – a technique similar to that used by the recently identified “ghost tapping” malware that exploited Android’s accessibility features. The malware maintains persistence through notification generation and uses the StartForeground API to remain active after system restarts.
The malware’s capabilities include extensive data theft functions and the ability to execute 57 distinct C2 commands, including camera and microphone recording. While initially connected to a CoinSwap phishing page, the malware later displayed Naver’s favicon and specific messaging patterns that indicated possible connections to the Kimsuky group. The sophisticated approach matches recent trends seen in other banking trojans like Anatsa, which successfully infiltrated the Google Play Store through seemingly legitimate applications.
While the exact distribution method remains undetermined, researchers discovered the malware disguised as utility applications on the Google Play Store. Security experts recommend implementing several protective measures, including careful scrutiny of app permission requests, maintaining updated antivirus software, and regular system updates to ensure current security patches. The recommendations are particularly important given the rising sophistication of mobile malware and the increasing integration of digital identity services in South Korea’s infrastructure.
Sources: GB Hackers, IndraStra Global, The Hacker News
Follow Us