Various pieces of evidence strongly suggest that the people behind this attack campaign are Chinese speakers, Maslennikov said. For example, the malware contains various functions written in Chinese, the Windows 2003 installation running on the control server is configured to use Chinese localization, and a Web page found on the server contains random Chinese text.
Tibetan and Uyghur activists have previously been targeted in APT-style attacks that infected their computers with Windows or Mac remote access tools (RATs). However, this new attack might be the first in a future wave of targeted attacks against Android users, the Kaspersky researchers said.
While this particular operation used social engineering to distribute the Android malware, the researchers expect attackers to start using exploits for zero-day vulnerabilities or other techniques to infect Android devices in the future. "We are almost 100 percent sure that we'll see attacks using exploits to infect Android devices without any kind of user interaction in 2013, and not only targeted attacks, but also attacks launched by traditional cybercriminals," Maslennikov said.