New Android Spyware LianSpy Evades Detection Using Yandex Cloud | Cybersecurity

Aug 06, 2024. Ravie Lakshmanan Android / Malware.

Users in Russia have been the target of a previously undocumented Android post-compromise spyware called LianSpy since at least 2021.

Cybersecurity vendor Kaspersky, which discovered the malware in March 2024, noted its use of Yandex Cloud, a Russian cloud service, for command-and-control (C2) communications as a way to avoid having a dedicated infrastructure and evade detection.

“This threat is equipped to capture screencasts, exfiltrate user files, and harvest call logs and app lists,” security researcher Dmitry Kalinin said in a new technical report published Monday.

It’s currently not clear how the spyware is distributed, but the Russian cybersecurity vendor is likely deployed through either an unknown security flaw or direct physical access to the target phone. The malware-laced apps are disguised as Alipay or an Android…