Imagine you’re browsing a local Kurdish news website, catching up on regional politics, and—bam!—your phone politely asks if it can take a selfie. Welcome to SilentSelfie, the most low-key cyber espionage campaign you’ll wish you never encountered. It’s the kind of attack that doesn’t need zero-day exploits or flashy hacks to get the job done. Nope, it’s the quiet kind, the “I’ll just sit here and siphon your location data while you browse” variety. Subtle, right?
What’s Going On?
In early 2024, Sekoia’s Threat Detection & Research (TDR) team uncovered a massive campaign targeting Kurdish websites. They didn’t just find one bad actor lurking in the corner—no, they discovered 25 Kurdish websites compromised by multiple variants of a malicious script. From basic location-stealing tactics to sneakily convincing users to install a malicious APK, this campaign had a bag of dirty tricks designed to gather intelligence on users in the Kurdish community.
And just in case you’re wondering, the hacks didn’t involve some mind-blowing new technique. Nope, they stuck to classic tools, proving once again that in cybersecurity, it’s not always about innovation; sometimes persistence is just as effective.
The Attack Breakdown
Let’s break down what these digital hooligans have been up to.
1. The First Variant: “Where Are You?”
The simplest version of the attack was about as blunt as a wooden spoon. It was found on 17 websites and only had one mission: to gather your location. When you’d visit a compromised site, it would silently invoke the gL() function, fetch your location, and send it off to a PHP script. Pretty sneaky, right? And, of course, it targeted users browsing on mobile—specifically Android and iPhones—because, why bother with PCs when your phone’s always by your side?
2. Variant Two: “Let’s Get Serious About Tracking”
The second variant stepped things up a bit. If you were lucky enough to visit ronahi[.]net, you’d find that the attackers had added user tracking through cookies. But here’s where they tripped up—they made a typo (classic). The malicious script was supposed to ping wo_cookies.php, but instead, they forgot the “s” and linked to a non-existent script, wo_cookie.php. Even the pros have off days.
3. Variant Three: “Smile for the Camera!”
Now, things got even creepier. Not only did this variant retrieve your location, but it also used your phone’s selfie camera to take a picture. It was like a first date you didn’t agree to. A compromised website would activate your camera, snap a quick selfie, and send it off, along with your screen resolution, battery status, IP address, and a bunch of other info. Oh, and they also made sure to track your public and local IPs using WebRTC. Because what’s a little selfie without a location, right?
4. Variant Four: “APK or Nothing”
The final variant took it up a notch. Here, you wouldn’t just get tracked or have your photo snapped—you’d be redirected to download a malicious APK (because every good watering hole attack needs a prize at the end). This version was found on three websites, including rojnews[.]news, and would redirect select users to install the APK. The reward? A compromised app that would steal your contacts, GPS location, and files. Yay, malware!
So What’s the Deal With the Malicious APK?
Once users installed the APK, it turned into a cyber Swiss Army knife. Using the Android WebView component (basically a mini web browser within the app), it displayed the website’s content while secretly running code that fetched your location and waited for further instructions from the command-and-control server. Oh, and the permissions it requested? Total red flags: access to your contacts, GPS, and storage. What could possibly go wrong?
Technical Details, Anyone?
For the tech-savvy among us, here’s a little extra flavor. The malicious APK used ProGuard to obfuscate its code, making it harder to detect. Once the app was opened, it activated a service called LocationHelper which started sending the user’s location back to a remote server. It even had commands lined up to retrieve system information, contacts, and files from the infected device.
If you’re a CVE fan (and let’s be honest, who isn’t?), you’ll want to track down some of the vulnerabilities that might have been abused here. While no specific CVE was tied to this campaign, the malware’s use of WebRTC to track local IPs, camera access, and geolocation could be linked to browser-based vulnerabilities we’ve seen before.
Who’s Behind This Cyber Circus?
If you thought this was just some run-of-the-mill attack by bored hackers, think again. While no conclusive attribution has been made, Sekoia researchers proposed a few possible actors. Here’s the breakdown of the suspects:
1. Turkey
Given the ongoing political tensions between Turkey and Kurdish forces, Turkey’s intelligence services could very well be behind this. After all, Turkey has been known to target Kurdish websites, especially those linked to the PKK (Kurdistan Workers’ Party). With three military operations under their belt against Kurdish forces in Syria, collecting GPS coordinates and pictures of potential adversaries seems like their kind of thing.
2. Kurdistan Regional Government (Iraq)
Another suspect is the Kurdistan Regional Government (KRG). The KRG has a rather complicated relationship with the PKK and has reportedly worked with Turkish intelligence in the past. The fact that RojNews, one of the compromised websites, is based in Iraqi Kurdistan adds a layer of suspicion.
3. Others
Syria and Iran were also floated as possibilities. Syria has a vested interest in the Rojava region, where many of these attacks took place, while Iran’s troubled relationship with its Kurdish population might explain its potential involvement. But to be honest, both these hypotheses feel like wild cards.
Why It Matters: More Than Just Spy Games
Sure, this campaign might seem like just another day in the cyber-espionage world, but it’s far more significant than that. For starters, this campaign went unnoticed for over a year. Imagine all the data that was harvested from users who had no idea their phones were acting as unwitting spies.
Moreover, the campaign wasn’t aimed at high-profile political figures or military targets—it was targeting everyday people browsing local Kurdish news sites. The sheer scale of the operation highlights just how vulnerable the average person is to surveillance and data theft.
FAQs: What You Need to Know
What’s a watering hole attack?
A watering hole attack is a strategy where hackers compromise websites that are likely to be visited by their targets. Instead of going after individuals directly, they set a trap on websites their targets frequent, hoping to lure them in and compromise their devices.
How do I protect myself from attacks like these?
To protect yourself, use a VPN when browsing, avoid installing APKs from unknown sources, and make sure your browser is up to date. If your browser asks to access your camera or location, take a second to think, “Do I really need this?”—the answer is probably no.
Could this attack happen again?
Absolutely. This is a classic example of low-sophistication yet high-impact cyber espionage. The tactics here weren’t groundbreaking, and the attackers didn’t need to use sophisticated exploits. Campaigns like this could easily resurface, particularly against vulnerable communities.
The Takeaway
At the end of the day, SilentSelfie is a reminder that even the most innocuous websites can harbor danger. It also underscores the importance of vigilance and cyber hygiene. Whether it’s refusing to download shady APKs or being cautious about sharing your location online, staying aware of the risks is your best defense.
As for the attackers, whether they’re state actors or rogue agents, their message is clear: you don’t need to be James Bond to get your phone compromised. Sometimes all it takes is a quick visit to your favorite news site.
