Confucius APT Android Spyware Targets South Asia

This report describes Confucius APT's mobile espionage campaign using two Android spyware strains, Hornbill and SunBird, embedded in fake apps to capture and exfiltrate sensitive data (calls, messages, geolocation, media, WhatsApp/BBM/IMO content) from targets in Pakistan and South Asia; SunBird also functions as a RAT with additional capabilities (root commands, scheduled uploads). Researchers recovered ~18GB of exposed exfiltrated data from insecure C2 servers, and the report provides IOCs (SHA1/SHA256 hashes, domains, IPs), a Windows downloader sample analysis, and defensive recommendations.