Skip to main content

GnatSpy Mobile Malware

GnatSpy is a family of malware which includes threats such as VAMP and FrozenCell. This family of mobile malware targets images, text messages, contacts and call history on infected devices.
Threat ID:
CC-1872
Category:
Threat Severity:
Low
Threat Vector:
Published:
20 December 2017 12:00 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

This content has been archived

This article no longer conforms to NHS Digital's standards for cyber alerts, and may contain outdated or inaccurate information. Use of this information contained in this page is at your own risk

Summary

GnatSpy is a family of malware which includes threats such as VAMP and FrozenCell. This family of mobile malware targets images, text messages, contacts and call history on infected devices.

Affected platforms

The following platforms are known to be affected:

Android

All android devices

Threat details

It can connect to Command and Control (C2) domains which can be used to exfiltrate data. The attackers send malicious files directly to the device for the users to download and install. The communication with the C2 servers is encoded to avoid detection.

Remediation steps

Type Step
  • Before installing applications, read user reviews which may highlight anything suspicious.
  • Ensure an anti-virus application is present on Android devices
  • Ensure that user data is regularly backed up.
  • Be aware of what permissions an application is requesting.
  • Always keep your mobile phone fully patched with the latest security updates.
  • Use the Google Play Store to obtain your software, and avoid downloading applications, even if they appear legitimate, from third-party stores.

Last edited: 17 February 2020 11:31 am