Since at least 2021, users in Russia have been targeted by a new form of Android spyware, identified as LianSpy, which had not been previously documented.
The cybersecurity firm Kaspersky, which uncovered this malware in March 2024, highlighted its use of Yandex Cloud—a Russian cloud platform—for its command-and-control operations. This strategy helps LianSpy avoid establishing its own infrastructure and evade detection.
Dmitry Kalinin, a security expert, outlined in a technical report released Monday that LianSpy is capable of capturing screenshots, stealing files, and collecting call logs and app lists.
The exact method of distribution for this spyware remains unclear, but Kaspersky suspects it may exploit an unknown security vulnerability or require physical access to the device. The malicious apps often masquerade as legitimate services like Alipay or Android system components.
Once installed, LianSpy checks if it operates with system app privileges or requests extensive permissions to access contacts, call logs, notifications, and overlay the screen. It also determines if it’s running in a debug environment to ensure its persistence across reboots, subsequently hiding its icon and initiating actions such as screenshot capture, data exfiltration, and configuration updates to specify the data to be gathered.
Some variants are capable of extracting data from popular Russian messaging apps and can be configured to operate based on whether the device is connected to Wi-Fi or a mobile network.
Kalinin explained that LianSpy updates its configuration by checking for a file matching the pattern “^frame_.+\.png$” on a threat actor’s Yandex Disk every 30 seconds. If such a file is found, it is downloaded into the app’s internal storage.
The stolen data is encrypted in an SQL database table, with each record’s type and SHA-256 hash specified. Only the threat actor with the corresponding RSA private key can decrypt this information.
LianSpy demonstrates advanced stealth capabilities by circumventing privacy indicators introduced in Android 12, which require apps to show status bar icons when requesting microphone and camera access. The developers of LianSpy bypass this by modifying the Android secure setting parameter icon_blacklist, preventing these icons from appearing.
Furthermore, LianSpy uses the NotificationListenerService to hide notifications from background services, ensuring they do not appear in the status bar.
A notable feature of LianSpy is its use of a renamed su binary (“mu”) to gain root access, indicating the possibility of delivery through an unknown exploit or direct device access.
The malware’s stealth is further demonstrated by its unidirectional command-and-control communication, using Yandex Disk solely for transmitting stolen data and storing configuration commands. Yandex Disk credentials are updated from a hard-coded Pastebin URL that varies among different malware variants, adding a layer of obfuscation.
LianSpy joins the ranks of sophisticated spyware tools targeting mobile devices, including Android and iOS, often exploiting zero-day vulnerabilities. “In addition to conventional espionage techniques like capturing call logs and app lists, LianSpy utilizes root access for hidden screen recording and evasion,” Kalinin noted. “Its reliance on a modified su binary suggests a secondary infection following an initial breach.”
