CIRK

CSIS Incident Response Kit is a targeted anti-virus application used by CSIS customers to detect campaigns targeted against them through advanced heuristics and analysis.

This involves investigating installed apps, collecting data from the device and uploading it to an encrypted server for further analysis.

Targeted malware is often custom tailored to the custom making them not easily detectable by Google