I believe the use of open source tools to accomplish their tasks is interesting. Using "living off the land" open source tools also hinders researchers when try

I believe the use of open source tools to accomplish their tasks is interesting. Using "living off the land" open source tools also hinders researchers when trying to attribute an attack to a certain country. I found malware that was installed remotely on to millions of Android users under the government "Life Line" program that also used readily available open-source code found on GitHub. The malware used an open sourced virtualization shared object library (.so) named "VirtulApp" and also an open source software development kit called "TalkingData" Both code sources were found on GitHub. The malware in question hides its icon from the users screen but can be found under Settings/Apps but shows an icon for a well-known "Antivirus/Cleaner" app that has been removed from the Google Play store many times. The malware also shares much of the cleaner app's SDK's and excessive permissions. The malicious app also contains several encrypted files in its assests directory that are decrypted into executable java .jar files to expand it's functionality. Kaspersky Labs names this particular malware variant "Necro" 5a5ab39960d3b96be2b8bbea99477e6f