ESET researchers have recently published new findings on a year-long mobile espionage campaign that was conducted by the BladeHawk group and targeted the Kurdish ethnic group via two Android backdoors disguised as legitimate applications. Since approximately March 2020, the campaign leveraged roughly six Facebook profiles (that have since been taken down from the platform) that appeared to have offered pro-Kurd and tech content. It is noted that two of the Facebook profiles targeted Android users and the additional four claimed to provide Kurdish supports news content while sharing links to applications with spyware in public Facebook groups. ESET researchers identified a minimum of twenty-eight posts that lead victims to downloading Android “888 RAT” or “SpyNote” malware, and that the fraudulent applications were downloaded 1,481 times from July 20, 2020, to June 28, 2021. In a report published this week, ESET attributed the year-long campaign to the BladeHawk group and explained that the espionage activity is also linked to two incidents that were reported in 2020, with one detailed by Chinese cybersecurity company QiAnXin as having the same, “modus operandi, with overlaps in the use of [command-and-control] C&C servers, 888 RAT, and the reliance on Facebook for distributing malware.” The following are several of the “888 RAT” malware’s main functions: stealing and deleting files, taking screenshots and photos, gathering device locations, gaining Facebook credentials, collecting a list of installed applications, recording audio and phone calls, making calls, sending text messages, and exfiltrating contacts lists as well as text messages. CTAPT analysts will monitor for future campaigns involving BladeHawk as well as “888 RAT”, as the malware has been quickly evolving its capabilities and has also been connected to two additional campaigns within the last year.