The distribution method of LianSpy is currently unclear, Kaspersky speculates it could be deployed through an unknown security flaw or direct physical access to the target device
A previously undocumented Android spyware, named LianSpy, has been targeting users in Russia since at least 2021, according to cybersecurity firm Kaspersky. The spyware, discovered in March 2024, uses Yandex Cloud, a Russian cloud service, for its command-and-control (C2) communications, helping it avoid detection by not relying on dedicated infrastructure.
“This threat is equipped to capture screencasts, exfiltrate user files, and harvest call logs and app lists,” said Dmitry Kalinin, a security researcher at Kaspersky, in a new technical report published Monday.
The distribution method of LianSpy is currently unclear. Kaspersky speculates it could be deployed through an unknown security flaw or direct physical access to the target device. The spyware disguises itself as either Alipay or an Android system service. Once activated, LianSpy checks if it’s running as a system app to operate in the background with administrator privileges or requests a wide range of permissions to access contacts, call logs, notifications, and overlay features.
LianSpy is also designed to detect if it’s running in a debugging environment, allowing it to set up a configuration that persists across reboots. It hides its icon from the launcher and can take screenshots, exfiltrate data, and update its configuration to capture specific information. Some variants can gather data from instant messaging apps popular in Russia and control malware activity based on network connections.
“To update the spyware configuration, LianSpy searches for a file matching the regular expression ‘^frame_.+\\.png$’ on a threat actor’s Yandex Disk every 30 seconds,” explained Kalinin. “If found, the file is downloaded to the application’s internal data directory.”
The stolen data is stored encrypted in an SQL database table, specifying the type of record and its SHA-256 hash. Only the threat actor, with the corresponding private RSA key, can decrypt the information.
LianSpy also bypasses the privacy indicators feature introduced by Google in Android 12, which requires apps requesting microphone and camera permissions to display a status bar icon. “LianSpy developers have managed to bypass this protection by appending a cast value to the Android secure setting parameter icon_blacklist, which prevents notification icons from appearing in the status bar,” noted Kalinin. It hides notifications from background services using the NotificationListenerService.
The spyware uses a modified su binary named “mu” to gain root access, suggesting it may be delivered through a previously unknown exploit or physical device access. LianSpy’s stealth capabilities are further highlighted by its unidirectional C2 communications, with the malware not receiving incoming commands. It uses Yandex Disk for transmitting stolen data and storing configuration commands. Credentials for Yandex Disk are updated from a hard-coded Pastebin URL, varying across malware variants, adding a layer of obfuscation.
LianSpy is the latest addition to a growing list of sophisticated spyware targeting mobile devices by exploiting zero-day flaws. “Beyond standard espionage tactics like harvesting call logs and app lists, it leverages root privileges for covert screen recording and evasion,” said Kalinin. “Its reliance on a renamed su binary strongly suggests secondary infection following an initial compromise.”
