Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint //


Stealth Mango Proves Malware Success Doesn't Require Advanced Tech

At Black Hat USA, a pair of researchers will show how unsophisticated software can still be part of a successful surveillance campaign.

Reports on new strains of malware and dissection of its operation are common at security conferences. Less common: Full end-to-end reports of the malware, the infrastructure underneath it, and the organization behind it. But on Aug. 9, that's what Lookout's Andrew Blaich and Michael Flossman will present at Black Hat USA.

"Our presentation is covering a targeted surveillance campaign where we identified an Android tool called Stealth Mango being deployed in targeted attacks, as well as a related iOS tool that was identified as being created by the same developers," says Flossman, head of Lookout's threat intelligence services. "While we do focus primarily on the Android tool and the information that the actors behind that tool were able to steal, we also dive into the background information around the group that was responsible for its development and creation."

Stealth Mango and the related iOS software, Tangelo, are surveillanceware that is based on technology developers use for their more common offerings in spouseware. "The capabilities are really similar between [Stealth Mango and], for example, a spouseware tool — an application that is something that you would deploy on your significant other's phone or desktop to keep tabs on them," Flossman says. "Basically what we've found in a lot of our investigations is that the kind of people that would deploy spouseware are interested in the same kinds of information that a nation-state would be interested in."

(See Blaich and Flossman's Black Hat USA talk on August 9, "Stealth Mango and the Prevalence of Mobile Surveillanceware")

The two researchers weren't necessarily looking for Stealth Mango when it showed up in the research. "We were just looking for interesting cases of surveillanceware, and as we were working in-depth and started to examine the malware and look at more about the servers it was talking to, we really discovered what we had on our hands there," says Blaich, security researcher and head of device intelligence at Lookout.

And what they had was a campaign that was successful despite its lack of cutting-edge technology or technique.

"We're quite certain that it was created specifically for this customer," Flossman says. "So in that regard, it's like a bespoke solution" — though one built almost entirely from "off-the-rack" parts.

"It's quite standard, and nothing really stands out," Flossman says. "What I would say is interesting is the overall context around its use: the actors deploying it, but also just how much success they've had with this tool despite what might be taken as a lack of sophistication."

That success offers an economics lesson to other threat actors. "It really shows that sometimes you don't need a very complex or expensive solution to achieve your goals," Blaich says.

"A good way of thinking about this is that if you purchased Pegasus and it came with a bunch of zero-day exploits, you'd be quite cautious in how you deploy them. You'd make sure that they never would fall into the hands of researchers because basically, if that happened, you'd be burning a zero-day investment which these days is well over $100,000," Flossman says. "Comparatively, an attack like [Stealth Mango] is something that would cost several thousand dollars, max."

Those several thousands dollars in this case would be spent with a group that Blaich and Flossman say has been behind earlier attacks against the Indian military, including Operation C Major and Operation Transparent Tribe. In the current Stealth Mango campaign, they're covering their bases by using both their surveillanceware and commodity Trojans like Crimson RAT.

Flossman says that the group's Trojan use isn't new, but, like the surveillanceware, it is evolving. "If we look at the mobile malware they used in [C Major and Transparent Tribe], it was even less sophisticated than what we saw now, so they've evolved that tool and have worked on building it out," he says. "And we can see they're getting a fair bit of value from the mobile side of things now."

"[As a whole], this ties back into providing really good insight into exactly what adversaries in the mobile space need to do in order to be effective," Flossman adds. "It's a lot lower than what we often expect."

Related Content:




Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
8/2/2018 | 2:48:20 PM

I wonder how many of us are exposed to these goods as we continue to listen to extensive vigilance.


curso de manutenção de notebook
User Rank: Ninja
7/30/2018 | 9:25:10 AM
It's a lot lower than what we often expect." Not only sophistication of attack is less bit also cost is less and the lilleyhood of attack is high as a result.
User Rank: Ninja
7/30/2018 | 9:23:32 AM
"And we can see they're getting a fair bit of value from the mobile side of things now." Obviously mobile is difficult but more likely as more people use mobile more than desktop.
User Rank: Ninja
7/30/2018 | 9:21:07 AM
Trojan use isn't new, but, like the surveillanceware, it is evolving. "If we look at the mobile malware they used in [C Major and Transparent Tribe], it was even less sophisticated Do less sophisticated but the same impact, a good day for hackers.
User Rank: Ninja
7/30/2018 | 9:19:16 AM
Stealth Mango
Stealth Mango and the related iOS software, Tangelo, are surveillanceware " I wonder how many of us are exposed to these wares as we keep hearing extensive surveillance.
User Rank: Ninja
7/30/2018 | 9:15:59 AM
Any tool
Obviously any tool may be good enough to exploits vulnerabilities, I think we need to take a look at vulnerabilities to address some of the security chalanges.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/10/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-08-11
An issue was discovered in certain configurations of GNOME gnome-shell through 3.36.4. When logging out of an account, the password box from the login dialog reappears with the password still visible. If the user had decided to have the password shown in cleartext at login time, it is then visible f...
PUBLISHED: 2020-08-11
django-celery-results through 1.2.1 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database.
PUBLISHED: 2020-08-11
There is a possible out of bounds read due to an incorrect bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-152225183
PUBLISHED: 2020-08-11
The Temi application 1.3.3 through 1.3.7931 for Android has hard-coded credentials.
PUBLISHED: 2020-08-11
radare2 4.5.0 misparses signature information in PE files, causing a segmentation fault in r_x509_parse_algorithmidentifier in libr/util/x509.c. This is due to a malformed object identifier in IMAGE_DIRECTORY_ENTRY_SECURITY.