Executive Summary
A highly sophisticated cyber-espionage campaign has been uncovered involving a fake Bahrain Alert Android application, which is being actively deployed to conduct surveillance on targeted individuals in Bahrain and the broader Gulf region. This malicious app, disguised as an official civil defense or government alert tool, leverages advanced social engineering and technical subterfuge to compromise Android devices, exfiltrate sensitive data, and enable persistent remote access. The campaign demonstrates a significant escalation in the abuse of trusted government branding, exploiting periods of civil unrest and missile alerts to maximize infection rates. Technical analysis reveals a multi-stage malware architecture, advanced evasion techniques, and a focus on high-value targets such as activists, journalists, and dissidents. The threat landscape is further complicated by the use of dynamic command-and-control infrastructure and the absence of official CVEs, making detection and mitigation particularly challenging.
Threat Actor Profile
The operators behind the fake Bahrain Alert app exhibit characteristics consistent with advanced persistent threat (APT) actors, though definitive attribution remains elusive. Technical artifacts, including Russian-language strings and package naming conventions, suggest the involvement of Russian-speaking developers. However, there is no direct evidence linking this campaign to a specific nation-state or known APT group. The campaign’s timing, targeting, and sophistication indicate a high degree of operational security and a deep understanding of both the regional threat environment and Android internals. The use of multi-stage loaders, encrypted payloads, and dynamic infrastructure points to a well-resourced adversary with experience in mobile surveillance operations. While some TTPs overlap with groups such as APT-C-23 (also known as "Two-tailed Scorpion"), the current evidence does not support a definitive attribution.
Technical Analysis of Malware/TTPs
The fake Bahrain Alert app is distributed primarily via phishing links, smishing (SMS phishing), and malicious websites that impersonate the Google Play Store and Bahraini government portals. Notable delivery domains include download[.]alert-bh[.]com, download[.]bh-security[.]com, playgoogle[.]alertbh[.]com, and bh-alert[.]com. The infection chain is engineered to maximize user trust, with lure pages mimicking official interfaces, fake install animations, fabricated reviews, and fraudulent “Verified by Play Protect” claims.
Upon installation, the app executes a four-stage malware chain. The outer shell (com.old.stem.Ematterassist) decrypts and loads an installer/lure component (com.kit.kitty), which presents civil defense branding and requests elevated permissions, including VPN and unknown-source install rights. This stage then installs a nested RC4 shell (biz.rely.melt.Hvoicemanual), which decrypts and loads the final remote access trojan (RAT) payload (com.kisa.octagonpanel). The RAT establishes persistent, covert surveillance and encrypted command-and-control (C2) communications.
The malware employs a range of advanced evasion and persistence techniques. These include poisoned ZIP metadata, encrypted containers disguised as font or JAR files (e.g., ZfChs.ttf, ZGdSEl.jar, payload.base), runtime DEX injection, and anti-removal watchdogs. The app hides its overlays from the recents screen, uses generic notifications to mask activity, and implements mechanisms to survive reboots and process kills.
Surveillance capabilities are extensive. The malware leverages accessibility APIs for continuous UI and screen monitoring, captures lockscreen credentials (PINs, patterns), intercepts SMS and contacts (including one-time codes), performs real-time screen capture, inventories installed applications, and deploys phishing overlays for banking and account credential theft. Remote operators can control the device UI and automate actions. The C2 protocol uses AES-GCM encryption over TCP, with embedded endpoints and a heartbeat mechanism for persistent connectivity. Notably, the malware’s VPN service can selectively disable network access for all apps except itself and select messengers, coercing victims to complete installation and maintain connectivity.
Exploitation in the Wild
The campaign has been observed targeting Bahraini citizens, particularly during periods of civil unrest and missile alerts. Distribution is opportunistic, leveraging smishing, social media, and direct links during high-alert periods to exploit fear and urgency. Victims are lured into installing the app under the pretense of receiving critical civil defense updates. The observed impact includes credential theft, interception of private communications, and full device compromise, enabling long-term surveillance and data exfiltration.
Technical analysis and proof-of-concept demonstrations by security researchers confirm the app’s ability to exfiltrate sensitive data, remotely activate device sensors, and maintain persistent access. While some code artifacts suggest a Russian-speaking developer, there is no direct evidence of nation-state involvement or attribution to a specific APT group in this campaign. The absence of an official CVE underscores the challenge of detection, as the threat is not a vulnerability in legitimate software but rather a case of malicious software distributed outside official channels.
Victimology and Targeting
The primary targets of the fake Bahrain Alert app are Bahraini citizens, especially those seeking emergency alerts during periods of civil unrest or missile attacks. High-risk groups include activists, journalists, dissidents, and civilians who are likely to trust government-branded communications. The campaign also poses a secondary threat to government and critical infrastructure sectors, as impersonation of official apps could facilitate broader access to sensitive environments. The use of bilingual (English/Arabic) content and references to organizations such as the UNDRR (United Nations Office for Disaster Risk Reduction) further enhances the credibility of the lure and expands the potential victim pool to include expatriates and regional stakeholders.
Mitigation and Countermeasures
Detection and mitigation of the fake Bahrain Alert app require a multi-layered approach. Organizations should alert on the installation of suspicious packages such as com.kisa.octagonpanel and com.kit.kitty, especially when observed in sequence. Monitoring for VPN services that block all traffic except select apps, accessibility services serializing UI trees, and hidden overlays can provide early indicators of compromise. Network defenders should hunt for APKs containing assets like ZfChs.ttf, payload.base, or ZGdSEl.jar, and monitor for repeated TCP sessions to C2 infrastructure with 5-second heartbeats and AES-GCM encrypted payloads.
Mitigation steps include immediate removal of suspicious apps, revocation of accessibility, SMS, and device admin roles, and blocking of known malicious domains and IP addresses at the network perimeter. User education is critical: individuals should be instructed to avoid sideloading apps, verify the authenticity of emergency communications, and only download applications from official app stores. During periods of crisis, organizations should proactively communicate with users to counteract social engineering attempts and provide clear guidance on safe practices.
References
Dream Security Blog: How a Fake Bahrain Civil-Defense App Turns a Phone Into a Listening Post, Lookout Threat Intelligence: Surveillanceware Targeting Middle East, ESET Research: Fake Bahrain Alert App Analysis, Kaspersky Securelist: Mobile APTs in the Middle East, MITRE ATT&CK for Mobile, NVD - National Vulnerability Database (no CVE assigned as of this report).
About Rescana
Rescana is a leader in third-party risk management (TPRM), providing organizations with a comprehensive platform to assess, monitor, and mitigate cyber risks across their digital supply chain. Our advanced threat intelligence and automation capabilities empower security teams to proactively identify emerging threats, streamline vendor assessments, and ensure compliance with global standards. For more information about how Rescana can help your organization strengthen its cyber resilience, please contact us at info@rescana.com.
