SOVA was earlier focusing on countries like US, Russia, and Spain, but in July 2022 it added several other countries including India to its list of targets.
The new mobile banking 'Trojan' virus - SOVA - that can secretly encrypt an Android phone for ransom and is difficult to uninstall, is targeting Indian customers.
India's federal cyber security agency issued an advisory saying that the virus has upgraded to its fifth version after it was first detected in Indian cyberspace in July."It has been reported to CERT-In that Indian banking customers are being targeted by a new type of mobile banking malware campaign using SOVA Android Trojan.
The first version of this malware appeared for sale in underground markets in September 2021 with the ability to harvest user names and passwords via keylogging, stealing cookies, and adding false overlays to a range of apps," the advisory said.
Here's all you need to know about the SOVA virus
SOVA can add false overlays to a range of apps and "mimic" over 200 banking and payment applications in order to con the Android user
The latest version of this malware hides within fake Android applications that show up with the logo of a few famous legitimate apps like Chrome, Amazon, NFT (non-fungible token linked to cryptocurrency) platform to deceive users into installing them.
The Indian Computer Emergency Response Team or CERT-In is the federal technology arm to combat cyber attacks and guards the Internet space against phishing and hacking assaults and similar online attacks. The agency said the malware is distributed via smishing (phishing via SMS) attacks, like most Android banking Trojans.
The lethality of the virus can be gauged from the fact that it can collect keystrokes, steal cookies, intercept multi-factor authentication (MFA) tokens, take screenshots and record video from a webcam and can perform gestures like screen click, swipe etc. using android accessibility service.
Another key feature of the virus, according to the advisory, is the refactoring of its "protections" module, which aims to protect itself from different victim actions. For example, it said, if the user tries to uninstall the malware from the settings or pressing the icon, SOVA is able to intercept these actions and prevent them by returning to the home screen and showing a toast (small popup) displaying "This app is secured".
It can jeopardize the privacy and security of sensitive customer data and result in "large-scale" attacks and financial frauds.
How does it work
As per the advisory, once the fake android application is installed on the phone, it sends the list of all applications installed on the device to the C2 (command and control server) controlled by the threat actor in order to obtain the list of targeted applications.
"At this point, the C2 sends back to the malware the list of addresses for each targeted application and stores this information inside an XML file. These targeted applications are then managed through the communications between the malware and the C2," it said.
How to protect your Android devce:
The CERT-In suggested some counter-measures and best practices that can be put into action by the users to keep safe from the virus.
Users should reduce the risk of downloading potentially harmful apps by limiting their download sources to official app stores, such as your device's manufacturer or operating system app store, they should always review the app details, number of downloads, user reviews, comments and "ADDITIONAL INFORMATION" section, it said.
One should also verify app permissions and grant only those which have relevant context for the app's purpose.
They should install regular Android updates and patches and not browse un-trusted websites or follow un-trusted links and exercise caution while clicking on the link provided in any unsolicited emails and SMSs.