Iranian hackers show strong interest in Android spying tools

AndroRAT and DroidJack both can read text messages and listen to calls

Iranian hackers are showing strong interest in malware that can secretly pull data from Android devices, which are popular in the Middle East.

The analysis comes from Recorded Future, a cybersecurity intelligence firm based in Somerville, Massachusetts.

One of Recorded Future's specialties is monitoring hacking forums, looking for clues and chatter that might indicate future attacks.

Over the last six months, there appears to have been high interest on Iranian hacking forums in remote access tools, or programs designed to listen to calls and collect text message and GPS data, according to a blog post.

The most-discussed tools were AndroRAT and DroidJack. AndroRAT is free and has been around for close to four years, while DroidJack appeared last year.

"With a low level of technical skill needed, open availability and strong community support on hacker forums, DroidJack and AndroRAT are likely to remain popular choices for threat actors seeking to take advantage of Middle Eastern mobile systems," Recorded Future wrote.

The fact that Iranian hackers are embracing them now shows that threat actors are adapting to go after platforms that are popular in their own countries or regions, the company wrote. The tools to do so may be easy to get.

DroidJack has its own website. It costs US$210, and its developers aren't cagey about the app's mission: "DroidJack gives you the power to establish control over your beloveds' Android devices with an easy-to-use GUI and all the features you need to monitor them."

droidjack Screenshot/DroidJack

DroidJack can provide a list of calls made by a victim's Android phone.

Tricking someone into installing such apps without their knowledge is illegal in most countries.

Symantec wrote in November 2014 that it found the names and phone numbers of people supposedly based in India who developed DroidJack.

AndroRAT has been an open-source project. Like DroidJack, it can be wrapped into a legitimate Android app's application package (APK) in order to deceive people into installing it.

"The sustained Iranian interest in AndroRAT, despite its age and declining chatter from other sources, could be due to the easy download access, including GitHub repositories, and available community support for deploying the malware," Recorded Future wrote.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Have an opinion on security? Want to have your articles published on CSO? Please contact CSO Content Manager for our guidelines.

More about Symantec

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Jeremy Kirk

Latest Videos

More videos

Blog Posts