Seven Signatures, One Report
A file that looks like random noise is not the same thing as random noise. One component in the Infamous Chisel malware framework maintains a running log of every file it has already transmitted: up to 16,384 MD5 hashes, written as raw binary data, stored inside a hidden file named google.index. Without prior knowledge of its function, the file presents as garbage. That detail appears in a joint malware analysis report published August 31, 2023, by seven allied intelligence and cybersecurity agencies.
The agencies are the UK National Cyber Security Centre (NCSC), the US National Security Agency (NSA), the US Cybersecurity and Infrastructure Security Agency (CISA, which assigned the report identifier AR23-243A), the US Federal Bureau of Investigation (FBI), New Zealand’s National Cyber Security Centre, Canada’s Centre for Cyber Security (CCCS), and Australia’s Signals Directorate (ASD). The document carries Crown Copyright 2023 and is archived at the George Washington University National Security Archive under two entries: document 32120 for the CISA version and document 32121 for the UK NCSC version, both dated August 31, 2023. No classification marking appears on the public release.
Seven national signatures on a single technical document carry a specific institutional meaning. Each agency is formally attesting to the analysis it contains. This is a co-authored intelligence product, and that provenance matters for assessing what the record can and cannot establish.
Not One Program, A Framework
The report describes Infamous Chisel as a collection of distinct components, each with a defined role. Persistence is achieved through a malicious replacement of the legitimate Android system binary at /system/bin/netd. When the device’s init process executes the malicious binary, it forks and continues running the original backed-up binary from /system/bin/netd_, preserving normal device function. The compromise runs with root privileges inherited from init. A separate component named killer can terminate the malicious netd process; a component named blob decompresses and launches the Tor process from bzip archives.
Remote access runs through a Tor hidden service, relaying connections to a modified version of the Dropbear SSH tool. The bundled multi-call binary also includes network scanning capability derived from nmap, SCP for file transfer, and tcpdump for capturing network traffic. The report describes the Tor binary as “likely actor compiled” for 32-bit ARM architecture.
File exfiltration runs on a timer: every 86,000 seconds, 23 hours, 53 minutes, and 20 seconds. Files are transferred via HTTP POST; a successful transfer is flagged when the server’s response contains the string “Success.” Before sending any file, the framework computes its MD5 hash and checks it against google.index. If the hash is already recorded, the file is skipped. The index holds up to 16,384 entries; when full, the write position resets and earlier entries are overwritten. The file is initialized as 256 kilobytes of null bytes and reads as structureless binary data to anyone inspecting the device without advance knowledge of its purpose.
What It Was Looking For
Exfiltration was selective. A hardcoded extension list governed which files were targeted, including common document formats and types specific to military use, among the latter, .kme and .kmz, formats associated with geospatial and mapping data. The report also lists GPS location data, hardware identifiers, installed application lists, Android ID and hardware information, network interface configurations, credentials and key files, and data from communications and messaging applications.
The extension list, as documented, is more complete than the directory list. The source document’s listing of targeted file-system directories appears truncated, meaning the full set of paths targeted for exfiltration is not confirmed by this record. What file types were sought is better characterized than where, exactly, the malware was directed to search for them.
The Agencies’ Answer
The seven agencies collectively concluded that Infamous Chisel was purpose-built for intelligence collection from Ukrainian military Android devices, and attributed it to Sandworm, publicly identified as the Russian GRU’s Main Centre for Special Technologies (GTsST), GRU Military Unit 74455. The advisory notes that agencies from the United Kingdom, United States, Australia, Canada, and New Zealand have previously linked Sandworm to GTsST.
The agencies assessed individual components as low to medium sophistication, showing little effort toward defense evasion or concealment. Their stated reasoning: many Android devices lack host-based detection systems, so the actors may have judged concealment unnecessary. Two aspects nonetheless required significant technical expertise, replacing the legitimate netd binary to achieve persistence, and modifying the Dropbear authentication function, both of which, the agencies noted, require a solid grounding in C++ and familiarity with Linux authentication and boot mechanisms.
That assessment spans nine MITRE ATT&CK categories: execution, persistence, privilege escalation, defense evasion, credential access, discovery, collection, command-and-control, and exfiltration. The campaign was assessed a serious threat because of the value of data the malware was positioned to collect, not because its concealment was sophisticated, but because it did not need to be. Paul Chichester, NCSC Director of Operations, stated at the time of publication that the exposure of the campaign illustrated how Russia’s illegal war in Ukraine continued to play out in cyberspace, a public comment on the report, not a technical finding within it.
The Silences, Named Precisely
Three things the report does not address. First: how Infamous Chisel arrived on target devices. The initial infection vector is not addressed anywhere in the document. Separately, Ukraine’s Security Service (SBU) assessed in August 2023 that Russian intelligence services had analyzed Ukrainian military tablets captured on the battlefield and used that access as a starting point for attempting to push malware to connected devices. That is a claim by the SBU, not a finding in the joint advisory, and the specific propagation mechanism remains unconfirmed in the public record.
Second: the number of devices successfully compromised and the volume of data extracted. The report states neither figure. Third: the identity of specific GRU operators or unit subdivisions beyond the organizational label GTsST. Attribution stops at the institutional level. None of these gaps is addressed elsewhere in the public record. The joint advisory of August 31, 2023 establishes, with technical precision, what the malware does, how each component functions, and who the agencies hold responsible. How it first reached those devices, how many it reached, and the complete map of where it was directed to search, those questions remain open.