Skip to content

Legitimate Android app iRecorder turns malicious within a year, spies on its users, ESET Research discovers

  • As a Google App Defense Alliance partner, ESET detected a trojanized app available on the Google Play Store and named the AhMyth-based malware it contained AhRat.
  • Initially, the iRecorder app did not have any harmful features. What is quite uncommon is that the application received an update containing malicious code quite a few months after its launch.
  • The application’s specific malicious behavior, which involves extracting microphone recordings and stealing files with specific extensions, potentially indicates its involvement in an espionage campaign.
  • The malicious app with over 50,000 downloads was removed from Google Play after ESET Research’s alert; ESET has not detected AhRat anywhere else in the wild.

BRATISLAVA, KOŠICE — May 23, 2023 — ESET researchers have discovered a trojanized Android app named iRecorder – Screen Recorder. It was available on Google Play as a legitimate app in September 2021, with malicious functionality most likely added in August 2022. During its existence, the app was installed on more than 50,000 devices. The malicious code that was added to the clean version of iRecorder is based on the open-source AhMyth Android RAT (remote access trojan) and has been customized into what ESET named AhRat. The malicious app is capable of recording audio using the device’s microphone and stealing files, suggesting it might be part of an espionage campaign.

Besides the Google Play Store, ESET Research has not detected AhRat anywhere else in the wild. However, this is not the first time that AhMyth-based Android malware has been available on the official store; ESET previously published research on such a trojanized app in 2019. Back then, the spyware, built on the foundations of AhMyth, circumvented Google’s app-vetting process twice, as a malicious app providing radio streaming. However, the iRecorder app can also be found on alternative and unofficial Android markets, and the developer also provides other applications on Google Play, but they don’t contain malicious code.

“The AhRat research case serves as a good example of how an initially legitimate application can transform into a malicious one, even after many months, spying on its users and compromising their privacy. While it is possible that the app developer had intended to build up a user base before compromising their Android devices through an update or that a malicious actor introduced this change in the app; so far, we have no evidence for either of these hypotheses,” explains ESET researcher Lukáš Štefanko, who discovered and investigated the threat.

The remotely controlled AhRat is a customization of the open-source AhMyth RAT, which means that the authors of the malicious app invested significant effort into understanding the code of both the app and the back end, ultimately adapting it to suit their own needs.

Aside from providing legitimate screen recording functionality, the malicious iRecorder can record surrounding audio from the device’s microphone and upload it to the attacker’s command and control server. It can also exfiltrate from the device files with extensions representing saved web pages, images, audio, video, and document files, and file formats used for compressing multiple files.

Android users who installed an earlier version of iRecorder (prior to version 1.3.8), which lacked any malicious features, would have unknowingly exposed their devices to AhRat if they subsequently updated the app either manually or automatically, even without granting any further app permission approval.

“Fortunately, preventive measures against such malicious actions have already been implemented in Android 11 and higher versions in the form of app hibernation. This feature effectively places apps that have been dormant for several months into a hibernation state, thereby resetting their runtime permissions and preventing malicious apps from functioning as intended. The malicious app was removed from Google Play after our alert, which confirms that the need for protection to be provided through multiple layers, such as ESET Mobile Security, remains essential for safeguarding devices against potential security breaches,” concludes Štefanko.

ESET Research has not yet found any concrete evidence that would enable the attribution of this activity to a particular campaign or APT group.

For more technical information about the malicious iRecorder app and AhRat, check out the blogpost “Android app breaking bad: From legitimate screen recording to file exfiltration within a year” on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

New Enhancements to Remote Assist

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About JumpCloud
At JumpCloud, our mission is to build a world-class cloud directory. Not just the evolution of Active Directory to the cloud, but a reinvention of how modern IT teams get work done. The JumpCloud Directory Platform is a directory for your users, their IT resources, your fleet of devices, and the secure connections between them with full control, security, and visibility.

SafeDNS: Ensuring the Most Sustainable Web Filtering Infrastructure

Recently, renowned researchers from Tel-Aviv University and Reichman University conducted a groundbreaking study on DNS resolvers and distributed denial-of-service (DDoS) attacks. Their research uncovered a severe complexity attack called NRDelegationAttack, which poses a significant threat to DNS resolvers. This attack can exhaust CPU resources and cause denial of service to legitimate users.

The study identified major resolver implementations, including BIND9, Unbound, and Knot, as vulnerable to NRDelegationAttack. The researchers issued three common vulnerabilities and exposures (CVEs) related to this attack. Testing on 16 open resolvers confirmed their susceptibility.

SafeDNS stands out as the web filtering solution with the most sustainable infrastructure, as confirmed by the provided data. In comparison to other major DNS resolvers, SafeDNS demonstrates exceptional performance in maintaining low latency and minimizing latency increase percentages.

According to the test results, SafeDNS exhibits remarkable consistency, with a mere 4.65% increase in latency from the first NXNS Attacker. This outstanding performance significantly outperforms many other resolvers, ensuring users experience minimal delays and enjoy a seamless browsing experience.

Moreover, when facing the NRDelegationAttack Attacker, SafeDNS experienced an increase of 5812.8% in latency, surpassing the performance of several other DNS resolvers. Notably, some of the other resolvers encountered ClientTimeout errors in response to the NRDelegationAttack Attacker, highlighting the robustness and reliability of SafeDNS.

These results underscore SafeDNS’s commitment to providing a sustainable infrastructure that delivers exceptional performance, security, and stability. Users can rely on SafeDNS to navigate the internet securely and efficiently, while experiencing minimal latency and maintaining a seamless browsing experience.

To learn more about this groundbreaking research, including detailed analysis and findings, please refer to the full research article.


Start using SafeDNS for free

Take advantage of the SafeDNS trial period and try all the best features

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SafeDNS
SafeDNS breathes to make the internet safer for people all over the world with solutions ranging from AI & ML-powered web filtering, cybersecurity to threat intelligence. Moreover, we strive to create the next generation of safer and more affordable web filtering products. Endlessly working to improve our users’ online protection, SafeDNS has also launched an innovative system powered by continuous machine learning and user behavior analytics to detect botnets and malicious websites.

Debunking the DNS Servers for Gaming Myth: Separating Fact from Fiction

In the gaming community, players are always seeking ways to optimize their gaming experience, including reducing latency. One popular topic that often arises is the use of specific DNS servers to enhance gaming performance. In this article, we debunk the myth surrounding DNS servers and gaming, explaining why they have limited impact on reducing ping. We will also provide alternative strategies to effectively improve your gaming experience.

The Myth: DNS Servers and Improved Ping

When it comes to gaming, some individuals believe that by using specific DNS servers, they can significantly reduce latency and enhance their gaming performance. The idea behind this belief is that connecting to nearby or faster DNS servers will result in quicker resolution times, leading to improved connection speeds and reduced ping during gameplay. However, this assumption oversimplifies the complexity of network performance. 

The Reality: Minimal Impact on Ping

While it may seem logical that connecting to optimized DNS servers would lead to improved gaming performance, the reality is that DNS resolution has limited impact on reducing ping or enhancing overall gaming latency. In most cases, the time it takes to resolve DNS queries is minimal compared to other factors influencing latency, such as the speed and quality of your internet connection, server distance, and network congestion.

To put it simply, even if you were to connect to the fastest DNS servers available, the improvements in ping would be marginal, if noticeable at all. The primary focus should be on addressing the factors that have a more significant impact on gaming performance.

Alternative Solutions for Enhanced Gaming Experience

To optimize your gaming experience, consider the following alternative strategies that have a more substantial impact on reducing latency and improving overall performance:

  1. Internet Speed and Quality:

Start by checking the speed and quality of your internet connection provided by your ISP. Ensure that you are subscribed to a plan that offers sufficient bandwidth and low latency for gaming. If necessary, consider upgrading to a higher-speed plan or exploring alternative internet service providers in your area.

2.  Network Optimization:

Optimize your network settings for gaming to reduce latency and improve stability. Here are a few steps you can take:

  • Utilize a wired connection instead of relying on Wi-Fi, as wired connections tend to offer lower latency and better stability.
  • Close bandwidth-intensive applications or downloads running in the background, as these can hog network resources and negatively impact your gaming experience.
  • Configure your router for gaming traffic, which may involve enabling Quality of Service (QoS) settings or prioritizing gaming traffic over other types of network traffic.

By implementing these alternative solutions, you can make significant improvements to your gaming experience without relying solely on specific DNS servers.

While the myth persists that using specific DNS servers can dramatically improve gaming performance, the reality is that DNS resolution has limited impact on reducing ping or overall gaming latency. Instead, prioritize factors such as internet speed and quality, as well as network optimization, to enhance your gaming experience. By focusing on these essential aspects, you can effectively optimize your gaming setup and enjoy a smoother and more enjoyable gaming experience.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SafeDNS
SafeDNS breathes to make the internet safer for people all over the world with solutions ranging from AI & ML-powered web filtering, cybersecurity to threat intelligence. Moreover, we strive to create the next generation of safer and more affordable web filtering products. Endlessly working to improve our users’ online protection, SafeDNS has also launched an innovative system powered by continuous machine learning and user behavior analytics to detect botnets and malicious websites.

Stopping the WiFi Password Hacker with NAC

In the digital age, where businesses rely on seamless connectivity and data exchange, corporate WiFi networks have become the backbone of modern operations. However, a growing concern looms over these networks: the alarming ease with which their passwords can be hacked. In this article, we explore the vulnerabilities that make corporate Wi-Fi networks susceptible to breaches, as well as the far-reaching consequences that such hacks have on businesses.

Unveiling the Vulnerabilities of Wireless Networks

The ease with which corporate WiFi network passwords can be hacked poses a dire threat to businesses, yet they continue to persist. Here are some of the reasons why WiFi passwords are so easy to hack:

  • Password Weakness: The Achilles’ heel of corporate WiFi networks often lies in weak passwords. Surprisingly, many organizations still employ generic or easily guessable passwords, providing hackers with a convenient entry point. Cybercriminals employ sophisticated tools capable of deciphering these passwords through brute-force attacks, exploiting the negligence of network administrators.
  • Flawed Network Configurations: Misconfigurations within WiFi networks often leave unintended openings for hackers. Despite advancements in security technologies, network administrators occasionally overlook crucial settings, unknowingly leaving the door ajar for malicious actors. For instance, obsolete authentication protocols like WEP, notorious for their vulnerabilities, can be exploited by skilled hackers to intercept and decrypt network traffic.
  • Human Factors: Internal personnel can inadvertently or deliberately facilitate unauthorized access to corporate WiFi networks. Employees with inadequate security awareness may fall victim to social engineering attacks, disclosing passwords or inadvertently introducing malware into the network. Furthermore, disgruntled employees or ex-staff members with malicious intent can leverage their insider knowledge to breach network security, causing significant harm to their former employers.

The Far-Reaching Consequences of a WiFi Hack

The consequences of a WiFi password hacker gaining access to a corporate wireless network extend beyond mere financial losses, potentially devastating an organization’s reputation and eroding customer trust. These consequences include:

  • Breach of Sensitive Data: Successful intrusions into corporate WiFi networks grant hackers unrestricted access to a treasure trove of sensitive business data. Confidential customer information, proprietary intellectual property, and critical financial records become vulnerable to exploitation. The repercussions can be devastating, including reputational damage, regulatory non-compliance penalties, and a loss of customer trust. Competitors may capitalize on stolen information, resulting in financial losses and compromised market position.
  • Misuse of Network Resources: Once infiltrated, hackers exploit the compromised corporate WiFi network for their nefarious activities. They may launch attacks on internal systems, infect devices with malware, or engage in illegal practices, such as distributing pirated content. The consequences are dire, ranging from compromised network performance and disrupted business operations to potential legal consequences for facilitating illegal activities.
  • Financial Burdens: The financial implications of WiFi network breaches are profound. Remediation efforts, including incident response, forensic investigations, legal services, and potential regulatory fines, can exact a heavy toll. Moreover, organizations may face indirect financial losses due to diminished business opportunities, decreased productivity, and customer attrition resulting from damaged reputation and eroded trust.
  • Operational Disruptions: A successful hack of a corporate WiFi network triggers significant operational disruptions. While IT teams work tirelessly to contain the breach, investigate the incident, and restore network integrity, the organization’s daily operations grind to a halt. The ensuing downtime leads to missed deadlines, dissatisfied customers, and severe financial ramifications.

Stopping the WiFi Password Hacker with NAC

To mitigate risks posed by a WiFi password hacker, businesses must prioritize robust security measures, including regular network audits, encryption standards, user access controls, and ongoing employee training. When it comes to user access controls in particular, a network access control (NAC) solution can help prevent someone from hacking the password for a corporate WiFi network through several mechanisms. Here are some ways NAC can enhance security:

  • User Authentication: NAC solutions can enforce strong user authentication methods, such as two-factor authentication (2FA) or certificate-based authentication. This ensures that only authorized users with valid credentials can connect to the network.
  • Access Policies: NAC solutions allow network administrators to define and enforce access policies. These policies can restrict access based on user roles, devices, or locations. By implementing granular access controls, the NAC solution can prevent unauthorized users from gaining access to the network, ultimately thwarting any WiFi password hacker.
  • Device Profiling and Security Checks: NAC solutions can perform device profiling, which involves collecting information about connected devices, such as device type, operating system, and security posture. The solution can then compare this information against predefined security policies and assess the risk level of the device. If a device is deemed insecure or non-compliant, the NAC solution can restrict or deny network access.
  • Network Segmentation: NAC solutions often include network segmentation capabilities. By dividing the network into separate segments or VLANs, the solution can isolate critical assets and restrict access between different segments. This way, even if an unauthorized user gains access to the network, they will face additional barriers when attempting to move laterally or escalate privileges.
  • Continuous Monitoring: NAC solutions provide ongoing monitoring of connected devices. They can detect anomalies, such as multiple failed login attempts, unusual network traffic patterns, or unauthorized devices connecting to the network. If suspicious behavior is detected, the NAC solution can trigger alerts or take automated actions, such as blocking the device or initiating additional security measures.
  • Integration with other Security Tools: NAC solutions often integrate with other security tools, such as firewalls, intrusion detection systems (IDS), or security information and event management (SIEM) systems. This integration allows for more comprehensive threat detection and response capabilities. For example, if the NAC solution detects a suspicious login attempt, it can communicate with the firewall to block the source IP address.

Proactively fortifying corporate WiFi networks allows organizations to safeguard their valuable assets, maintain business continuity, and thrive amidst the escalating cybersecurity challenges of the digital era. By implementing a robust NAC solution with these features, an organization can significantly reduce the risk of password hacking attempts and enhance the overall security of their corporate WiFi network.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。