Indian APT Group DONOT Misuses App for Intelligence Gathering

Cyfirma links Android apps named “Tanzeem”/“Tanzeem Update” to the Indian APT group DONOT; the apps abuse OneSignal for phishing, request accessibility and other sensitive permissions, harvest call logs, SMS, contacts, location and files, and exfiltrate data to Appspot-based C2 domains (e.g., toolgpt.buzz, Solarradiationneutron.appspot.com) with a reported SHA-256 hash, targeting individuals and organizations in South Asia.