The Cyber Azov application is an ingenious creation of the Russian authorities: disguised as a pro-Ukraine application, it is in fact a malicious Trojan horse.
Fortunately, the application did not really have time to circulate and was downloaded very little. However, it was still available for download on Android on Tuesday morning.
A disguised Trojan horse
The application activity was identified by Google’s TAG (the Threat Analysis Group) which has been closely monitoring Russian cybercriminal activities since the start of the invasion of Ukraine. According to him, the application was created by Turla, a group of hackers associated with the Russian security services. Turla is also the name of the Trojan supposedly created by authorities in Russia to destabilize Western governments, and has been active malware since 2005.
The application pretends to be a creation of the Azov regiment, a detachment of the Ukrainian national guard. She notably uses her coat of arms as an icon. Cyber Azov claims to attack Russian institutions by DDoS (in French “attack by denial of service”) by sending mass requests to Russian government sites in order to overwhelm them.
The cyber war continues
However, the number of downloads remains low and the application does not achieve its goal. According to TAG, Cyber Azov is copied from a real application created by an independent developer to support Ukraine, called “Stop War”. The latter encourages anyone to support the Ukrainian war effort by simply downloading the application.
The TAG also warned of the exploitation of a recent vulnerability by the Russian authorities and other interested agents of the conflict. Several cybercriminal actors seem to be exploiting the Follina vulnerability, made public at the end of May 2022. It allows hackers to control computers through doctored Word documents. And according to Google researchers, groups affiliated with the Russian military are using Follina against Ukrainian media.
The Ukrainians are not left out: the cyber army coordinated a series of DDoS attacks against Russia on Telegram, despite limited means.
Source : The Verge
8