GREF is a China-aligned APT group targeting Uyghur communities with BadBazaar malware.
Analyst brief
GREF is a China-aligned APT group active since at least 2017. They primarily target Android users, especially Uyghurs and other Turkic ethnic minorities outside of China. Their key TTPs involve distributing the BadBazaar malware through official and alternative app stores, using trojanized versions of popular messaging apps like Signal and Telegram. Defenders should prioritize monitoring for custom Android malware and focus on strict application allowlisting and download source vetting to counter these mobile threats.
GREF
unknown
GREF is a China-aligned APT group that has been active since at least March 2017. They are known for using custom backdoors, loaders, and ancillary tools in their targeted attacks. Recently, they have been attributed to two active Android campaigns that distribute the BadBazaar malware through malicious apps on official and alternative app stores. GREF has targeted Android users, particularly Uyghurs and other Turkic ethnic minorities outside of China, using trojanized versions of popular messaging apps like Signal and Telegram.
Which mobile platform does the GREF APT group target?+
They target Android users, especially Uyghurs and other Turkic ethnic minorities.
What should defenders focus on against GREF?+
They should prioritize monitoring for custom Android malware, especially altered messaging apps, and enforce strict application allowlisting and download source vetting.