@BushidoToken Threat Intel

Introduction Russian state-sponsored threat groups, such as Fancy Bear (APT28), Cozy Bear (APT29), Turla, and Sandworm, among others, are well-known for complex cyber-espionage operations, targeted intrusions, destructive attacks, and disinformation campaigns. Some of the capabilities of Russian threat groups, however, are not well-known and extend beyond the usual targeting of government and critical infrastructure enterprise networks. The main three Russian intelligence services (GRU, FSB, and SVR) have also conducted less well-known and underreported intelligence gathering campaigns against Android and iPhone users delivering spyware as well as collecting credentials for specific mobile applications. In this blog, I will be examining open source intelligence (OSINT) reports, leveraging the findings and citing investigations conducted by other threat researchers, to present my key findings and an overall assessment of these mobile threat campaigns. Background on Mobile Threat...

  Android banking Trojans are an interesting threat because if successful, it can be a huge payday for a cybercriminal and a terrible loss for the victim. The latest wave of Android banking threats have a range of advanced features, all designed to clear out a victim's bank account.  The majority of these threats are distributed via malicious SMS text messages, the Google Play Store, Social Media, or watering hole sites. These types of threats also largely require the users to be unaware of the danger of granting unsafe permissions to apps, such as Android Accessibility Services - one of the main functions that Android malware heavily relies on to perform financially motivated attacks. The Android Banking Trojan Nexus (see above) is supposed to help fraud teams and security researchers identify and track Android banking Trojans designed to steal funds from their customers' accounts. Tracking the latest and greatest Android threats is a valuable venture. From my experience of ...

  Following the recent discoveries shared by @MalwareHunterTeam and @LukasStefanko on Twitter, I took a closer look at the ongoing Cerberus Android banking Trojan campaign. It has recently reared its head to target English-speaking users via a fake food delivery app: (Figure 1 - The fake website that drops food-delivery.apk) (Figure 2 - Downloading and granting permissions to the Trojanised application) If successfully downloaded and permissions are granted, the user's device is infected with a banking Trojan that shares multiple similarities to the infamous Cerberus Android banking Trojan. Further investigation in this campaign revealed the attacker's infrastructure through a mutual host, gTLD (.top), and the same registrant details.  Virus Total Graph of the campaign: Themes of Trojanised Applications distributed by this Cerberus operator: Cerberus web injects database: (Figure 3 - Picture of the Cerberus web injects database for reference) Analysis: The Cerberu...

The Joker Trojan (also known as the Bread Trojan) is an Android dropper with spyware capabilities. It is often hidden within advertisements to trick users into clicking on and downloading the malware. Usually, it only targets SIM cards with specific country codes, geo-fencing the victims. It is used by financial attackers to harvest a user's device information, contact list, text messages, and will sign them up to premium subscriptions. APK Lab recently disclosed that two available apps that contain the Joker Trojan managed to sneak past protection systems and were uploaded to the Google Play Store. The apps containing the Trojan, called ‘Speed Message’ and ‘Botmatic Messages’, currently have over 11,000 installs combined: VirusTotal Graph: Once installed, the malware contacts the attacker’s C2 server and pulls the malicious payload. Further investigation into the IP address of the attacker’s C2 server led me to find three more apps, called ‘Playful Game Station’, ‘Watch SMS’, ...

I recently set out to become more acquainted with Maltego, a useful program for open-source intelligence (OSINT) and forensics, developed by Paterva. I also noticed there is an ongoing campaign against Turkey using Android banking Trojans such as Anubis and Cerberus. Both are Malware-as-a-Service offerings that supply a builder and mobile remote access Trojan (MRAT) to steal credentials from Android users. Security researchers such as @MalwareHunterTeam, @ReBensk, @pr3wtd, and @mertcangokgoz, and others have all recently shared new samples of Cerberus and Anubis targeting users in Turkey with mobile data “gifts” that are offered from their mobile carriers due to COVID-19. Various websites are registered hosting links to fake apps, which were downloaded from the threat actor’s GitLab or BitBucket repositories. These apps are Android packages (.APK) that can be distributed via SMS, instant messaging app, on Twitter, via email, and other social engineering techniques. With the ...