For those who came in late, Infamous Chisel is the tracking name for new malware designed to backdoor devices and steal critical information.  It is a collection of components that enable persistent access to an infected Android device over the Tor network and which periodically collates and exfiltrates victim information from compromised devices.

“Five eyes” Intelligence officials from the UK, US, Canada, Australia, and New Zealand warn that the information exfiltrated is a combination of system device information, commercial application information and applications specific to the Ukrainian military."

Infamous Chisel gains persistence by replacing the legitimate system component known as netd with a malicious version. Besides allowing Infamous Chisel to run each time a device is restarted, the malicious netd is also the main engine for the malware.

It uses shell scripts and commands to collate and collect device information and also searches directories for files with a predefined set of extensions. Depending on where on the infected device a collected file is located, netd sends it to Russian servers either immediately or once a day. Infamous Chisel uses the TLS protocol and a hard-coded IP and port when exfiltrating files of interest.

Using the local IP address is likely a mechanism to relay the network traffic over a VPN or other secure channel configured on the infected device. This would allow the exfiltration traffic to blend in with expected encrypted network traffic. If a connection to the local IP and port fails, the malware returns to a hard-coded domain that's resolved using a request to DNS. Google.

Infamous Chisel also installs a version of the Dropbear SSH client that can be used to access a device remotely. The version installed has authentication mechanisms modified from the original version to change how users log in to an SSH session.

The report didn't say how the malware gets installed. In the advisory Ukraine's security service issued earlier this month, officials said that Russian personnel had "captured Ukrainian tablets on the battlefield and were using them to spread malware and abuse available access to penetrate the system.