Hackers working on behalf of the Syrian government are targeting political opponents with surveillance malware being distributed in trojanised versions of messaging applications including WhatsApp and Telegram.

The Syrian Electronic Army group of hackers works in support of Syrian President Bashar Al-Assad and targets groups and individuals opposed to his regime. The group also has a history of hacking into and defacing websites -- including that of the US army -- and social media accounts, the most high profile of which saw the Twitter account of the Associated Press compromised.

Such is the notoriety of the SEA that the US charged three Syrian nationals with being members of the group in 2016, with two added to the FBI's Most Wanted List.

In recent years, the group has seemingly kept a low profile, but the SEA hasn't ceased activity: it's altered tactics and is now delivering custom Android malware to opponents of the Assad regime for the purposes of surveillance.

Dubbed SilverHawk by researchers at security firm Lookout, they detailed their findings at the Black Hat Europe conference in London. The malware is thought to have been in operation since mid-2016 and is capable of secretly recording audio, taking photos, downloading files, monitoring contacts, tracking location and more.

"You can imagine the implications for political dissidents who might be in sensitive meetings and the enemy would love to know what they're talking about -- if their phone's infected, they can just remotely start recording audio," said Kristen Del Rosso, security intelligence engineer at Lookout.

SEE: Cyberwar predictions for 2019: The stakes have been raised

The Google Android malware isn't widely spread, suggesting that the SEA is using it sparingly in highly targeted campaigns. The main method of delivering SilverHawk is by tricking victims into downloading malicious versions of messaging apps from watering hole sites or social engineering via phishing emails.

"Typically you'll see this deployed inside trojanised secure messaging applications, secure connectivity applications and that was the case here," said Michael Flossman, head of threat intelligence at Lookout. "The threat actors behind this really favour trojanising updates to WhatsApp, Telegram as well as a system package update."

To help remain undetected, the malicious app doesn't place an icon on the home screen. SilverHawk has also been built to avoid the rapid battery drain which can be a telltale sign that a malicious app has been installed. The creators of the malware have built in a survival counter that gives it two attempts to connect back to its command and control servers.

"What happens is every time there's a connection to the command and control servers that's successful, it resets to two, then every time a connection isn't made or the C2 server is down it drops down by one," Del Rosso explained.

"When the device is rebooted, however, the counter is back to 2, allowing the surveillance-ware to attempt to continue its spying abilities," she added. It also prevents repeated attempts at connection from draining the battery and arousing suspicion that something is wrong.

Analysis by Lookout suggests that SilverHawk has been successful in carrying out its tasks and remaining stealthy as the malware has rarely needed to be reworked to avoid detection by security solutions, and when changes have been made, they're relatively minor.

SEE: Can Russian hackers be stopped? Here's why it might take 20 years (TechRepublic cover story) | download the PDF version

While SilverHawk only targets Google Android on mobile devices, the Syrian Electronic Army is also known to target dissidents using Windows malware, with delivery typically via phishing emails containing attachments related to military operations in the region. Common forms of malware used in these campaigns include NjRAT, H-Worm Plus and DarkComet.

In instances of both the Android and Windows campaigns the use of open directories and poor operational security by the attackers has enabled Lookout to attribute the attacks to the SEA.

"There is no indication that they are using this tooling or the associated infrastructure that we've identified in targeted attacks against western interests at this time," Flossman told ZDNet.

However, he has advice for anyone who might be asked to install a version of a messaging service which asks for total control of the phone in exchange for installing the app.

"You should probably not fall for what they're saying when they ask for administrator access as that'll give them compromising control over your device," he said.

READ MORE ON CYBER CRIME

European law enforcement agencies scored a big win this week against criminals active on the Dark Web. In a press release today, Europol revealed that police in 13 countries conducted 300 house searchers and arrested 235 suspects who bought counterfeit euro banknotes from a Dark Web marketplace.

All arrests made today are related to a successful case handled by the Austrian Federal Criminal Police Office in June in 2018 when they tracked down and arrested the owner of a Dark Web portal selling counterfeit money.

A source knowledgeable of the case's details told ZDNet today that the suspect had failed to protect his operation's business transactions with proper encryption. While the suspect used cryptocurrency to receive payments, he still kept a list of mailing addresses where he sent packages containing the counterfeit banknotes.

Austrian authorities seized the suspect's hardware and later found a list of all past customers, which it then passed to Europol and other law enforcement agencies across Europe.

Besides taking down the Dark Web shop selling counterfeit money, authorities also dismantled the owner's euro banknote printing shop, located in Leoben, Austria.

According to Europol, the suspect's shop was capable of printing 10, 20 and 50 euro banknotes. Authorities said he printed and shipped over 10,000 counterfeit banknotes before his arrest.

During this past week's crackdown on the shop's buyers, authorities recovered 1,500 counterfeit banknotes. During the 300 house searches, authorities also found drugs, weapons, Bitcoins, hardware for mining virtual currencies, a cannabis plantation, but also an additional illegal euro counterfeit print shop --the last two located in France.

At the end of May this year, Europol announced a continent-wide crackdown on illegal Dark Web activities. While drugs and weapons are often cited as the most prevalent products that someone could buy on the Dark Web, counterfeit currency is just as popular and easy to find.

Below is just three Dark Web portals selling counterfeit euro banknotes that this reporter was able to find within one minute. Other shops selling US dollars, Russian rubles, or British pounds were also just as easy to locate.

Austrian police have played a major role in the past two years when it comes to bringing down counterfeit money printing shops operating on the Dark Web.

In February 2017, they dismantled an illegal euro banknote print shop in Vienna, and with the data obtained from that case, Europol coordinated the arrests of 53 other suspects.

In September 2018, Austrian authorities worked with Polish police to dismantle another money counterfeiting network operating in the Polish city of Gdynia.

Both criminal operations had been selling their counterfeit currency on the Dark Web, but apparently failed when it came to securing their sites.

More security news:

A Marriott spokesperson said the hotel chain is working on a way to reimburse some users for the costs of getting new passports if they're one of the persons whose data was leaked in a massive data breach last week.

Not all users will be reimbursed, a spokesperson said, but only those users who can prove they've been the victims of fraudulent operations where the passport number was involved.

"We are setting up a process to work with our guests who believe that they have experienced fraud as a result of their passports being involved in this incident," said Connie Kim, Marriott spokesperson, in an email to The Washington Post.

"If, through that process, we determine that fraud has taken place, then the company will reimburse guests for the costs associated with getting a new passport," she added.

The hotel chain's statement came after New York Democrat Senator Chuck Schumer publicly called on Marriott to pay for people's passport replacement fees over the last weekend.

"The data breach at Marriott compromised millions of travelers' U.S. passport info," Schumer said. "A new passport costs $110. Marriott must personally notify customers at greatest risk. And Marriott should pay the costs of a new passport for victims who request it."

The Marriott data breach was announced exactly a week ago. The hotel chain said hackers had gained access to the hotel guest reservation system used at Marriott subsidiary Starwood, and its smaller brands, including W Hotels, St. Regis, Sheraton Hotels & Resorts, Westin Hotels & Resorts, Element Hotels, Aloft Hotels, The Luxury Collection, Tribute Portfolio, Le Méridien Hotels & Resorts, Four Points by Sheraton and Design Hotels.

Marriott said hackers stole the personal details of over 500 million users, and for over 327 million, those details might have also included a passport number. Marriott put up a website that offered information for affected guests.

Marriott was sued within hours after announcing the data breach, and official investigations were set in motion in several US states and countries around the globe.

A Reuters report this week cited sources inside the hack investigation and claimed that the hack might have been the work of Chinese government hackers.

The hotel chain is also believed to be on the hook for as much as $3.5 billion in data breach expenses, according to industry accepted figures.

More data breach coverage: