Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label Malware Trojan. Show all posts
URL
Antivirus System Cyberciminals CyberCrime Cybersecurity CyberThreat Cyberthreats Digital Threat File Download malware Malware Trojan Ransomware Software URL

How to Check If a Downloaded File Is Safe to Use

 


It is no longer a secret that downloading software is becoming an integral part of everyday computing in today’s digitally based environment. It is used to enhance productivity, explore new tools, and stay connected to an ever-increasing online world, all of which are aided by downloads of software. While instant downloads have many advantages, if they are not approached with due diligence, they can also pose significant risks. 

A variety of harmful software, including malware, spyware, and adware, can be easily embedded into seemingly harmless files, potentially compromising personal information or system functionality. Given this, users need to take a cautious and informed approach before they execute any downloaded file. 

By following a few simple steps to verify a file’s safety, for example, scanning it for antivirus, and signing it with a digital signature, users can greatly reduce their vulnerability to cybersecurity risks. 

As digital threats continue to evolve, awareness and prevention remain the best defences for a constantly evolving cyber environment. While downloading files from the internet is now part of current daily lives, it is not without its risks. Cybercriminals often take advantage of this habit by disguising malicious software, like viruses, trojans, ransomware, and a wide variety of other forms of malware, as legitimate software. 

The threats are often disguised as harmless files, making it easy for the uninitiated to become victims of data loss or security breaches. This is why it is imperative to use caution when downloading any content, regardless of the source, regardless of whether the source seems trustworthy. The risk of infection can be significantly reduced by practising due diligence by scanning files using antivirus software, checking for digital signatures, and avoiding unknown or suspicious links when it comes to downloading files. 

With the ever-evolving digital threat landscape, users must take precautions about file safety, not just as a recommendation, but as a necessity. Users across the globe are increasingly concerned about the risk of downloading malicious software unintentionally from the internet. It is possible to install malicious programs on a computer system just by clicking a single careless button. 

A malicious program could compromise the integrity of the system, take sensitive data, or render a computer inoperable. As a result of SonicWall's Cyber Threat Report 2021, there were more than 5.6 billion malware attacks recorded in 2020 alone, a staggering figure that indicates how persistent this threat has become. 

A malware infection is usually caused by deceptive email attachments, compromised websites, and software downloads that appear legitimate but are laced with hidden dangers, resulting in the infection of a device. As a result, many users unknowingly expose themselves to such risks when they install a file or application that they believe is safe and secure. As a result, it highlights the importance of being vigilant and informed when it comes to navigating the digital world. Anyone who wants to protect their digital environment must understand how malware spreads, adopt proactive safety habits, and become aware of the dangers lurking within downloadable files.

For organisations to strengthen their cybersecurity protocols, it is imperative to have a thorough understanding of the hidden threats lurking within downloadable files. A fairly common infection vector is malicious email attachments that are sent as part of an email. There is a common practice among cybercriminals of using deceptive emails to distribute infected files disguised as regular documents, such as invoices, reports, or internal memos, that contain infected files. It has been shown that these attachments can unleash email-based viruses which will infiltrate entire company networks and spread quickly, leading to widespread disruption. There is also a threat vector that resides within seemingly harmless documents from Microsoft Office. 

Word or Excel documents, for example, may contain malicious macros—automated scripts embedded within them. When an unsuspecting recipient enables macros, these scripts silently execute, causing the system to be compromised with malware. These types of attacks are especially dangerous because they appear to be standard business communication when they are, in fact, very dangerous. 

Compressed files such as .zip and .rar also pose a significant threat. Often, threat actors hide harmful executable files within these archives, making it more difficult for them to be detected. Once those files are extracted and executed, they can instantly infect a device, granting unauthorized access, or causing further damage to the network infrastructure. 

Given that these threats are becoming increasingly sophisticated and subtlebusinesses must develop proactive strategies that can prevent them from becoming infected in the first place. An organization might be able to prevent malicious software from entering its organisation by implementing comprehensive employee training programs, strict file filtering policies, advanced threat detection tools, and regular updates to software. 

The prevention of malicious software begins with awareness and continues through rigorous cybersecurity practices and disciplined digital hygiene. There is a potential security risk associated with every file that user download from the internet, whether it is a file attached to an email, a multimedia file, or something that appears harmless like a screen saver. It is possible for familiar sources to unknowingly transmit compromised files, which is why vigilance is essential in every digital interaction. 

Here are a few critical practices that need to be followed to protect both personal devices and organisational networks. To greatly reduce the possibility of infection with harmful software, it is imperative to exercise digital caution and apply sound judgment by avoiding downloads from unknown or suspicious sources. Users are significantly less likely to become infected with dangerous software. When users initiate a download, they should use a reputable website that has a secure (HTTPS) connection and has a well-known domain name. 

Users can prevent fraud by checking the URL bar of the site to ensure its legitimacy. Moreover, fraudulent emails continue to be a very common vehicle for distributing malware. Links and attachments within unsolicited or unexpected messages should never be opened without verifying that the source is genuine. If users encounter suspicious pop-ups or warnings while browsing, they would be wise to close them by clicking the close (X) button in the browser rather than engaging with them. 

A second method of protecting against malware is to save files on people's devices before opening them, which will allow their antivirus software to scan them and alert them to any potential threats that may exist. In addition to verifying the file extension, reading user reviews and comments can provide valuable insights, as previous users may have already reported security issues or hidden dangers.

Media files, for example, should never be delivered in executable (.exe) format, because this indicates malicious intent. Although these practices are simple in nature, they nonetheless serve as a powerful means of avoiding the growing threat of a complex and constantly evolving digital environment. 

Importance of Robust Antivirus and Antimalware Software 


Luigi Oppido, a computer expert, emphasised the importance of installing reputable antispyware, antivirus and antispyware programs such as Norton, AVG, Malwarebytes, or Avast. These programs provide an important line of defence by actively scanning files as soon as they are downloaded, which provides a vital line of defence by identifying and blocking malicious software before it reaches users' computers. Antivirus applications are often integrated into operating systems, which should be enabled and monitored for any security alerts to make sure they do not get infected. 

Download from Trusted Sources 


It is important to note that files obtained exclusively from official websites of established companies, like Microsoft, are much less likely to have any malware attached to them. In contrast, downloading files from less well known or unreliable websites poses a higher threat. In addition to enhancing security, using official digital distribution platforms such as Microsoft Store or Apple App Store adds another layer of protection since these platforms thoroughly vet software before listing it. 

Verify Website Authenticity


As a result of cybercriminals creating spoofed websites using subtle variations in the domain names, users can often be deceived by spoofed sites (e.g., “microsoft.co” rather than “microsoft.com”). As a guide, users should look for signs of a trustworthy site, including a professional site design, a lack of excessive pop-ups or spam links, and the presence of SSL/TLS certificates, which can be recognised by the “https” and padlock icon on the browser. 

Awareness of Download Context 


A significant portion of the risk associated with downloading a file is determined by the source of the download. Files from dubious places, like torrent sites or adult content platforms, are often highly dangerous, and often contain malware or viruses. Files that resemble official software or originate from reputable companies are generally less dangerous.

Recognise Browser and System Warnings

It is important for users to heed warnings sent by modern browsers and antivirus programs when they are interested in downloading suspicious websites or potentially dangerous files. They must acknowledge these warnings and avoid proceeding with questionable downloads.

Check User Feedback and File Reputation


Reviews and comments left by users, whether on the hosting website or independent forums such as Reddit and Quora, can offer insights into the safety of a download. A positive reaction from multiple users will typically indicate a lower risk of malware infection. 

File Size Considerations


Several clues can be provided by the file size of a file. Usually, the size of a file is an indication of its legitimacy. An unusually small file may contain incomplete data or disguised malware. An unexpectedly large file may carry unwanted or harmful extras along with its intended purpose. 

Caution with Executable and Archive Files


It is common for malware to manifest itself in executable files (e.g., “.exe,” “.bat,” “.msi,” “.scr”) that were sourced from unknown locations. Hackers often use double extensions such as “.gif.exe” in order to trick consumers into executing harmful software. People using devices like laptops, computers, or mobiles must verify the source and digital signature of the executable file before opening it, since it grants an individual extensive control over the system. 

Digital Signatures and Licensing


Whenever users are running software on Windows, digital signatures and license warnings serve as indicators of authenticity. There is no guarantee that every executable is safe, no guarantee that every executable is intended to do harm. However, these factors can guide risk assessments before the installation of software is performed. 

The temptation to bypass security alerts, such as those that appear after a Windows update or warn that i file is potentially dangerous, arises whenever software is installed, and in the rush to do so, security warnings can be easily dismissed or disabled. However, these alerts serve a crucial function in protecting systems against potential threats. 

With Windows SmartScreen and other similar security mechanisms, users get more than just traditional antivirus software; they look at file reputations and behavioural patterns, which can often allow them to detect malware that conventional signature-based scanners may miss. As a precautionary measure, rather than switching off these protections, it is prudent to use such alerts as an opportunity to assess the file's safety using well-established verification methods rather than turning them off.

A major point to remember is that legitimate software rarely triggers multiple security warnings; encountering several warnings should be considered a clear red flag, indicating that the file may pose serious risks. To prevent infections and ensure the integrity of computer systems, one must maintain constant vigilance and respect these security layers.
Read more »
Remote Access Trojan
Data Breach data security Data Theft Fake Documents Fake PDF Info Stealer Malware Attack Malware Trojan Malwares Remote Access Trojan

Malware Hides in Fake PDF to DOCX Converters to Target Crypto Wallets and Steal Data

 

Cybercriminals have launched a deceptive malware campaign that disguises itself as online file converters, specifically targeting users searching for PDF to DOCX tools. This scheme uses convincing replicas of popular converter sites to execute hidden PowerShell scripts and deploy a Remote Access Trojan designed to steal sensitive data, including cryptocurrency wallets and browser credentials. 

Security researchers at CloudSEK investigated the threat following an FBI warning issued last month. They discovered that attackers are using a malware variant called Arechclient2, derived from the known info-stealing family SectopRAT. The campaign works by luring unsuspecting users to malicious websites that impersonate legitimate services like PDFCandy. These fake platforms feature realistic user interfaces, including loading indicators and CAPTCHA forms, to establish trust before delivering the malware. When a user attempts to convert a file, they are redirected multiple times before receiving a ZIP archive named “adobe.zip.” Inside the archive is the malicious payload, which installs the Arechclient2 Remote Access Trojan. 

This malware, active since 2019, is capable of scanning for browser-saved credentials, cryptocurrency wallet seed phrases, and even tapping into decentralized finance tools via Web3 APIs. Stephen Ajayi, Technical Lead at Hacken’s Dapp Audit division, explained that the malware not only lifts crypto wallet details but also enables attackers to “ghost-drain” assets after a transaction approval—making it especially dangerous for Web3 users. CloudSEK advises users to avoid downloading tools from unofficial or unverified sites, particularly free online file converters. Instead, they recommend trusted offline software or tools from official sources. 

They also warn that malicious files often disguise themselves using harmless-looking extensions, so users should inspect file types carefully and use reliable antivirus or endpoint detection software. Ajayi emphasized the importance of a proactive security mindset. “In cybersecurity, trust should be earned. Assume nothing is safe by default,” he said. He advised crypto users and general web users alike to adopt a zero-trust approach, keep their security tools updated, and monitor systems for unusual activity such as rogue msbuild.exe processes. 

As threats like these evolve, staying vigilant, maintaining strong security protocols, and preparing for worst-case scenarios are critical steps for avoiding compromise. Regular training and a well-tested incident response plan remain key defenses against such deceptive but damaging attacks.
Read more »
Triada
Android devices Android Smartphone counterfeit Cyberattacks CyberCrime Cybersecurity CyberThreat Global Security malware Malware Trojan Remote Access Trojan Triada

Triada Malware Embedded in Counterfeit Android Devices Poses Global Security Risk

 


There has been a significant increase in counterfeit Android smartphones in recent years. Recently, cybersecurity investigations have revealed a concern about counterfeit Android smartphones. These unauthorized replicas of popular mobile devices, which are being widely circulated and are pre-loaded with Triada, a sophisticated Android-based malware, are being offered at attractively low prices, causing widespread confusion and widespread fear. 

As a Remote Access Trojan (RAT) that was originally discovered during campaigns targeting financial and communication applications, Triada can be used to gain covert access to infected devices through covert means. Triada is designed to steal sensitive data from users, such as login information, personal messages, and financial information, which is then discreetly harvested. 

The cybersecurity experts at Darktrace claim that Triada employs evasion techniques to avoid detection by the threat intelligence community. In some cases, data can be exfiltrated through command-and-control servers using algorithmically generated domain names, which is an approach that renders conventional threat monitoring and prevention tools ineffective because of this approach. 

In the wake of a recent discovery, it has been highlighted that malicious software embedded on the firmware of mobile devices, particularly those sourced from vendors that are unknown or unreliable, poses a growing cybersecurity threat. As a consequence of the presence of malware prior to user activation, the threat becomes much more serious. Experts recommend that consumers and businesses exercise greater caution when procuring mobile hardware, especially in markets where devices are distributed without any government regulation. 

Additionally, it has become more important for mobile threat defense systems to be more sophisticated, capable of detecting deeply embedded malware as well as ensuring their effectiveness. There is a strong need for robust supply chain verification methods, effective endpoint security strategies, and an increased awareness of counterfeit electronics risks as a result of these findings. Kaspersky Security experts have warned consumers against purchasing significant discounts on Android smartphones from unverified online platforms that are deemed untrustworthy. 

There have been reports that more than 2,600 compromised devices have been delivered to unsuspecting users, most of whom are already infected with a sophisticated form of mobile malware known as Triada, which has been found to be prevalent in Russia. According to Kaspersky's research, the latest variant of Trojan is not merely installed as a malicious application, but is incorporated into the firmware of the device as well. 

Android's system framework layer is where this malware is situated, which makes it possible for it to infiltrate every single process running within the system. Because of this deep-level integration, the malware is able to access the entire system, while evading traditional detection tools, resulting in a particular difficulty in identifying or removing it using conventional techniques. This Trojan, which was first identified in 2016, has gained notoriety due to its ability to operate mainly in the volatile memory of an Android device, making it extremely difficult to detect. Its modular nature allows it to operate on a variety of Android devices. 

It has become more complex and stealthy over the years, and multiple instances have been documented in which the malware has been integrated into the firmware of budget Android smartphones that are sold through unreliable retailers that have been unauthorized. Triada is a highly persistent threat because its firmware-level embedding makes it impossible to remove it using conventional removal techniques, and it requires a full ROM reset to eradicate. 

According to Kaspersky's latest analysis, the most recent strain of Triada continues to possess sophisticated evasion capabilities. To maintain continuous control and access, the malware burrows into the Android system framework and replicates itself across all active processes. When the malware is activated, it executes a variety of malicious functions on compromised devices. It is possible for hackers to hijack the credentials of users from social media networks, manipulate WhatsApp and Telegram to send or delete messages under the guise of the user, intercept or reroute calls by using spoofing phone numbers, and more. 

Further, this malware allows users to make premium SMS payments and monitor web activity, alter hyperlinks, replace cryptocurrency wallet addresses during transactions, and monitor web activity. This malware is also capable of installing other programs remotely and disrupting network connectivity to bypass security measures or hinder forensic investigations, thus resulting in unauthorized financial losses.

According to Kaspersky's telemetry, this Triada variant has already been diverted approximately $270,000 worth of cryptocurrency, even though the full extent of the theft remains unclear due to the fact that privacy-centric cryptocurrencies such as Monero are being used in the operation. Although it is still unclear what the exact vector of infection was, researchers strongly believe that an infection could have occurred during the manufacturing or distribution stages of the device.

It is increasingly becoming clear that modified variants of Triada are being found in devices other than smartphones, including tablets, TV boxes, and digital projectors, that are based on Android, as well as smartphones. A broader fraudulent campaign known as BADBOX has been associated with these infections, which are often the result of compromised hardware supply chains and unregulated third-party marketplaces that have allowed the malware to gain initial access to the user's system. 

Triada developed into a backdoor that was built into the Android framework backdoor in 2017. This backdoor allows threat actors to remotely install more malware on the affected devices and exploit the devices for malicious purposes using various malicious operations. Google's 2019 disclosure revealed that, as a general rule, infection typically occurs during the production stage when original equipment manufacturers (OEMs) outsource custom features, such as facial recognition, to third parties. 

In such cases, these external developers may modify entire system images, and they have been implicated in injecting malware such as Triada into the operating system. Google's identification as Yehuo or Blazefire led to one of these vendors being cited as a potential contributor to the spread of the malware. 

Kaspersky confirmed in its analysis of samples that the Trojan is integrated into the system framework, which facilitates its replication across all processes on the device and allows unauthorized actions such as credential thefts, covert communications, manipulation of calls and SMS, substitution of links, activation of premium services, and disruption of network connectivity to occur. There's no doubt that Triada is not an isolated example of supply chain malware, as Avast revealed in 2018 that several Android devices made by manufacturers like ZTE and Archos are also preloaded with an adware called Cosiloon that is preloaded on them. 

According to Kaspersky's ongoing investigation, the latest strain of Triada has been found to be embedded directly within the firmware of compromised Android devices, primarily in their system framework. With this strategic placement, the malware is able to integrate itself into all the active processes on the device, giving the attacker complete control over the entire system. 

In a recent article published by Kaspersky Security, cybersecurity specialist Dmitry Kalinin highlighted the persistant threat posed by the Triada malware family, describing it as one of the most intricate and persistent malware families that targets Android devices. This was due to the fact that malware can often be introduced to devices before they even reach the end user, probably because of a compromised point along the way in the manufacturing or supply chain process, leaving retailers unaware that the devices they are distributing are already infected. 

The malware can perform a wide variety of harmful activities once it becomes active, including taking control of email accounts and social media accounts, sending fraudulent messages, stealing digital assets such as cryptocurrency, spying on users, and remotely installing malicious software to further harm their system. 

A growing number of experts advise consumers and vendors to be extremely cautious when sourcing devices, especially from unofficial or heavily discounted marketplaces, as this system is deeply integrated and has the potential to lead to large-scale data compromises, particularly when the devices are purchased online. For users to be safe from deeply embedded, persistent threats like Triada, it is imperative that the supply chain be audited more stringently, as well as robust mobile threat defense solutions are implemented.
Read more »
RATs
CloudFlare Cyber Attacks LNKs Malware Attack Malware Campaign Malware Trojan RATs

Abuse of Cloudflare Tunnel Service for Malware Campaigns Delivering RATs

 

Researchers have raised alarms over cybercriminals increasingly exploiting the Cloudflare Tunnel service in malware campaigns that predominantly distribute remote access trojans (RATs). This malicious activity, first detected in February, utilizes the TryCloudflare free service to disseminate multiple RATs, including AsyncRAT, GuLoader, VenomRAT, Remcos RAT, and Xworm. Cloudflare Tunnel service allows users to proxy traffic through an encrypted tunnel to access local services and servers over the internet without exposing IP addresses. 

This service is designed to offer added security and convenience by eliminating the need to open public inbound ports or set up VPN connections. With TryCloudflare, users can create temporary tunnels to local servers and test the service without requiring a Cloudflare account. However, threat actors have abused this feature to gain remote access to compromised systems while evading detection. A recent report from cybersecurity company Proofpoint observed that malware campaigns are targeting organizations in the law, finance, manufacturing, and technology sectors with malicious .LNK files hosted on the legitimate TryCloudflare domain. The attackers lure targets with tax-themed emails containing URLs or attachments leading to the LNK payload. 

Once launched, the payload runs BAT or CMD scripts that deploy PowerShell, culminating in the download of Python installers for the final payload. Proofpoint reported that an email distribution wave starting on July 11 sent out over 1,500 malicious messages, a significant increase from an earlier wave on May 28, which contained fewer than 50 messages. Hosting LNK files on Cloudflare offers several advantages to cybercriminals, including making the traffic appear legitimate due to Cloudflare’s reputation. 

Additionally, the TryCloudflare Tunnel feature provides anonymity, and the temporary nature of the subdomains makes it challenging for defenders to block them effectively. The use of Cloudflare’s service is not only free and reliable but also allows cybercriminals to avoid the costs associated with setting up their own infrastructure. 

By employing automation to evade blocks from Cloudflare, these criminals can use the tunnels for large-scale operations. A Cloudflare representative stated that the company immediately disables and takes down malicious tunnels as they are discovered or reported by third parties. Cloudflare has also implemented machine learning detections to better contain malicious activity and encourages security vendors to submit suspicious URLs for prompt action. 

In light of this increasing threat, it is crucial for organizations to remain vigilant and enhance their cybersecurity measures to defend against these sophisticated malware campaigns.
Read more »
Symantec
Cyber Attacks Cyberhacking Hacker attack Hacker group Kimsuky Linux Malware Malware Trojan North Korea Hackers Software Symantec

North Korean Hacker Group Kimsuky Deploys New Linux Malware 'Gomir' via Trojanized Software Installers

 

North Korean hacker group Kimsuky has unveiled a new Linux malware named "Gomir," a variant of the GoBear backdoor. This development marks a significant advancement in the group's cyber espionage tactics. Kimsuky, linked to North Korea’s military intelligence, the Reconnaissance General Bureau (RGB), has a history of sophisticated cyber attacks aimed primarily at South Korean entities. 

In early February 2024, researchers at SW2, a threat intelligence company, reported a campaign by Kimsuky involving trojanized versions of various software solutions. These included TrustPKI and NX_PRNMAN from SGA Solutions and Wizvera VeraPort. The primary targets were South Korean entities, and the malicious software delivered the Troll Stealer and Go-based Windows malware known as GoBear. 

Further investigation by Symantec, a Broadcom company, revealed that the same campaign also deployed a Linux variant of the GoBear backdoor, dubbed "Gomir." This new malware shares many similarities with its Windows counterpart, featuring direct command and control (C2) communication, persistence mechanisms, and support for executing a wide range of commands. Upon installation, Gomir checks the group ID value to determine if it runs with root privileges on the Linux machine. 

It then copies itself to /var/log/syslogd for persistence, creates a systemd service named ‘syslogd,’ and issues commands to start the service. Following these steps, the original executable is deleted, and the initial process is terminated. To ensure it runs on system reboot, the backdoor attempts to configure a crontab command by creating a helper file ('cron.txt') in the current working directory. If successful, the helper file is removed. Gomir supports 17 operations triggered by commands received from the C2 via HTTP POST requests. 

These operations include pausing communication with the C2 server, executing arbitrary shell commands, reporting the current working directory, probing network endpoints, and more. Notably, these commands are almost identical to those supported by the GoBear Windows backdoor, highlighting the malware's versatility and Kimsuky's ability to adapt its tools across different operating systems. Symantec researchers have pointed out that supply-chain attacks, such as trojanized software installers and fake installers, are a preferred attack method for North Korean espionage actors. 

The choice of software for trojanization seems to be carefully selected to maximize infection rates among South Korean targets. By compromising widely used software solutions, Kimsuky increases its chances of infiltrating targeted systems and exfiltrating valuable data. The implications of Kimsuky's activities are significant. By enhancing their malware capabilities and expanding their target range to include Linux systems, Kimsuky poses a heightened threat to organizations, particularly those in South Korea. 

The use of advanced malware like Gomir demonstrates the group's continuous evolution and sophistication in cyber espionage. Symantec's report on this campaign includes a set of indicators of compromise (IOCs) for multiple malicious tools observed, including Gomir, Troll Stealer, and the GoBear dropper. These IOCs are crucial for cybersecurity professionals to detect and mitigate the impact of these threats. 

As the digital landscape continues to evolve, the need for robust cybersecurity measures becomes ever more critical. Organizations, especially those in high-target regions like South Korea, must remain vigilant and proactive in their defense strategies. This includes regularly updating software, conducting thorough security assessments, and implementing comprehensive threat detection and response mechanisms. 

The emergence of Gomir and similar threats underscores the importance of international cooperation in combating cybercrime. By sharing intelligence and collaborating on cybersecurity initiatives, nations can better protect their critical infrastructure and sensitive data from sophisticated threat actors like Kimsuky.
Read more »
Trojan
Android Bank Cyber Security Banking Malware Banking scam Hydra Malware malware Malware Trojan Trojan

Hydra Malware Targets Germany's Second Largest Bank Customers

 

The Hydra banking trojan has resurfaced to target European e-banking platform users, especially Commerzbank customers, Germany's second-largest financial institution. 

MalwareHunterTeam discovered the two-year-old virus in a fresh dissemination operation that targets German users with a malicious APK called 'Commerzbank Security' with a lookalike icon to the legitimate application. 

This grabbed the attention of Cyble researchers, who sampled the file for a more in-depth study, revealing a sophisticated phishing tool with broad rights access. 

According to Cyble experts, Hydra is still evolving; the variations used in the latest campaign include TeamViewer features, similar to the S.O.V.A. Android banking Trojan, and utilize various encryption methods to avoid detection, as well as Tor for communication. 

The latest version additionally allows to turn off the Play Protect Android security function. The virus demands two very hazardous permissions, BIND_ACCESSIBILITY_PERMISSION and BIND_DEVICE_ADMIN, according to the experts. 

The Accessibility Service is a background service that assists users with disabilities, and the BIND_ACCESSIBILITY_SERVICE permission permits the app to access it. 

The analysis published by Cyble states, “Malware authors abuse this service to intercept and monitor all activities happening on the device’s screen. For example, using Accessibility Service, malware authors can intercept the credentials entered on another app.” 

“BIND_DEVICE_ADMIN is a permission that allows fake apps to get admin privileges on the infected device. Hydra can abuse this permission to lock the device, modify or reset the screen lock PIN, etc.” 

Other rights are requested by the malware to carry out harmful activities such as accessing SMS content, sending SMSs, making calls, modifying device settings, spying on user activity, and sending bulk SMSs to the victim's contacts: 
  • CHANGE_WIFI_STATE : Modify Device’s Wi-Fi settings 
  • READ_CONTACTS: Access to phone contacts 
  • READ_EXTERNAL_STORAGE: Access device external storage 
  • WRITE_EXTERNAL_STORAGE: Modify device external storage 
  • READ_PHONE_STATE: Access phone state and information 
  • CALL_PHONE: Perform call without user intervention 
  • READ_SMS : Access user’s SMSs stored in the device 
  • REQUEST_INSTALL_PACKAGES : Install applications without user interaction 
  • SEND_SMS: This allows the app to send SMS messages 
  • SYSTEM_ALERT_WINDOW: The display of system alerts over other apps 
The code analysis shows that many classes are missing from the APK file. To avoid signature-based detection, the malicious code uses a custom packer. 

Cyble concluded, “We have also observed that the malware authors of Hydra are incorporating new technology to steal information and money from its victims. Alongside these features, the recent trojans have incorporated sophisticated features. We observed the new variants have TeamViewer or VNC functionality and TOR for communication, which shows that TAs are enhancing their TTPs.” 

“Based on this pattern that we have observed, malware authors are constantly adding new features to the banking trojans to evade detection by security software and to entice cybercriminals to buy the malware. To protect themselves from these threats, users should only install applications from the official Google Play Store.” 

18 million potential targets

Commerzbank has 13 million German clients and another 5 million in Central and Eastern Europe. This amounts to a total of 18 million potential targets, which is always an important factor for malware distributors. 

Typically, threat actors utilise SMS, social media, and forum postings to direct potential victims to malicious landing pages that install the APK on German devices. 

If anyone believes they have already fallen into Hydra's trap, it is suggested that they clean their device with a trustworthy vendor's security tool and then do a factory reset.
Read more »
Subscribe to: Posts (Atom)