Overview
The APT-C-35 (DoNot Team) has deployed a new Android malware called Tanzeem with sophisticated features targeting intelligence collection. The malware masquerades as chat applications while exploiting Android permissions and OneSignal platform
Whom it may concern
- Mobile security teams
- Intelligence agencies
- Android application developers
- Users in Pakistan and Afghanistan
Key Findings
- Malware exploits accessibility services API for unauthorized actions
- Uses legitimate OneSignal platform for command and control
- Collects sensitive data including:
* Call logs
* Contacts
* SMS messages
* Location data
* Account information
Risk Analysis
- Probability: High (90% targeting success rate)
- Impact: Severe (complete data compromise)
- Attack persistence through push notification abuse
- Detection possible through permission monitoring
Action Items
- Implement runtime permission monitoring
- Deploy mobile threat defense solutions
- Update security awareness training
- Review OneSignal implementation security
Sources
- [The Hacker News](https://thehackernews.com/2025/01/donot-team-linked-to-new-tanzeem.html)
- [Cyfirma Analysis Report](Referenced in source)
