Researchers have attributed two (2) new Android spyware variants to the China-linked advanced persistent (APT) group APT41 (otherwise known as Winnti, Wicked Panda, and BARIUM). APT41 has been active since 2012 and historically targeted both public and private organizations, such as “nation-state governments, software development companies, computer hardware manufacturers, telecommunications providers, social media companies, and video game companies,” with the goal of financial gain as well as espionage. Researchers noted that it is rare for APT41 to be exploiting mobile platforms, as the group typically exploits web-facing applications and traditional endpoint devices. APT41 has been linked to two (2) Android spyware variants, “WyrmSpy” and “DragonEgg”, which are detailed by researchers as having sophisticated data collection and exfiltration capabilities. The two (2) malware variants have been observed with overlapping Android signing certificates and have infrastructure that is shared with APT41 from between May 2014 and August 2020. Researchers also explained that WyrmSpy and DragonEgg have different targeting scopes and are believed with medium confidence to be delivered through social engineering. WyrmSpy primarily disguises itself as a “default operating system app” for Android and is known to escalate its privileges once executed on a victim device. The malware then performs spyware functions, including uploading log files, photos, and device location. The malware also potentially collects audio recordings and SMS messages. DragonEgg disguises itself as “third-party keyboard or messaging apps” and is known to request various permissions from the device. The malware potentially collects device contacts, location, photos, audio recording, SMS messages, and external device storage files. CTIX analysts will continue to monitor emerging spyware and provide campaign details as available. Indicators of compromise (IOCs) and technical details can be viewed in the report linked below.