WyrmSpy and DragonEgg: Lookout Attributes Android Spyware to China’s APT41 | Threat Intelligence
Summary
- Lookout attributes WyrmSpy and DragonEgg to infamous Chinese espionage group APT41, which has not slowed down since recent indictments by the U.S. government.
- APT41 is known to target a wide range of public and private sector organizations, including nation-state governments, software development companies, computer hardware manufacturers, telecommunications providers, social media companies, and video game companies.
- An established threat actor like APT41 turning their focus to mobile devices shows that mobile endpoints are high-value targets with coveted data.
- WyrmSpy and DragonEgg use modules to hide their malicious intentions and avoid detection.
- WyrmSpy and DragonEgg were first reported to Lookout Threat Intelligence Services subscribers in October 2020 and January 2021 respectively in full write-ups that included IOCs, YARA rules, and additional threat analysis.
![](https://kbin.life/media/cache/resolve/entry_thumb/0d/bf/0dbfab55fcdb6557b4136023d10eee939f5167b3af4420971c1c7a07b45d9ea8.jpg)