The Android malware comes from threat group APT-C-23, also known as Two-Tailed Scorpion and Desert Scorpion.