A Russian programmer, Kirill Parubets, discovered advanced spyware on his mobile device after it was confiscated by Russia’s Federal Security Service (FSB) during his 15-day detention for allegedly donating to Ukraine.

The malware, identified through forensic analysis by Citizen Lab, masqueraded as the popular ‘Cube Call Recorder’ Android app. This sophisticated spyware appears to be an evolution of Monokle, previously developed by St. Petersburg-based Special Technology Center, Ltd.

Key Capabilities of the Spyware:
– Real-time location tracking
– Access to SMS, contacts, and calendar
– Call recording and screen capture
– Camera surveillance
– Message and password extraction
– Shell command execution
– Keylogging functionality
– Package installation
– File exfiltration

Technical Analysis:
The malware employs a two-stage encrypted process with enhanced security features compared to its predecessor. Citizen Lab’s investigation revealed potential iOS compatibility, suggesting a possible iPhone variant exists.

Notable Permission Changes:
– Added: ACCESS_BACKGROUND_LOCATION and INSTALL_PACKAGES
– Removed: USE_FINGERPRINT and SET_WALLPAPER

Security Recommendations:
– Replace confiscated devices after law enforcement returns them
– Use temporary devices in high-risk situations
– Enable advanced security features like Apple’s Lockdown mode
– Maintain current software and security updates

This incident highlights the sophisticated surveillance capabilities of state actors and the importance of digital security awareness.