mapping app

A malicious variant of the Alpine Quest navigation app has been identified, specifically targeting Russian military Android devices. Security experts from Doctor Web discovered that this modified app contains the Android.Spy.1292.origin spyware, which collects sensitive information and executes remote commands. The spyware is distributed as a free download through a deceptive Telegram channel, marketed as a premium version of the legitimate app. Upon installation, it transmits data such as the user's phone number, account details, contact list, geolocation data, and stored files to a remote server. It also communicates with a Telegram bot controlled by the attackers, providing updated location information. The spyware can download additional modules to extract specific content, particularly documents from messaging platforms like Telegram and WhatsApp. It searches for a file named locLog generated by Alpine Quest, which records user movements. Doctor Web advises against downloading apps from unofficial sources and warns that malicious applications can bypass review processes on official app stores. The identity of the group behind this campaign is unknown, but there are previous associations with Ukrainian hacktivist factions targeting Russian military personnel.