December 5, 2024 at 11:15AM
A new Android remote access trojan (RAT) called DroidBot targets 77 banking institutions and organizations. Disguised as security apps, it utilizes keylogging and UI monitoring. Active since June 2024, it operates on a Malware-as-a-Service model, with affiliates customizing the malware for attacks predominantly across Europe.
### Meeting Takeaways – December 5, 2024
**Overview of DroidBot Malware:**
– **Target Profile:** 77 banking institutions, cryptocurrency exchanges, and national organizations targeted.
– **Type:** Android remote access trojan (RAT) named DroidBot.
**Malware Characteristics:**
– **Capabilities:** Combines VNC and overlay attacks with spyware-like features (keylogging, user interface monitoring).
– **Communication:** Uses dual-channel communication:
– **Outbound Data:** Transmitted via MQTT.
– **Inbound Commands:** Received through HTTPS.
– **Operation Model:** Functions on a malware-as-a-service (MaaS) model at a cost of $3,000/month, accessible to at least 17 affiliate groups.
**Disguise and Distribution:**
– **Appearance:** Malicious apps masquerade as security applications, Google Chrome, or well-known banking apps.
– **Deployment Regions:** Most campaign activities observed in Austria, Belgium, France, Italy, Portugal, Spain, Turkey, and the UK.
**Technical Specifics:**
– **Functionality:** Abuses Android accessibility services for data harvesting and device control.
– **Communication Structure:** Uses MQTT for categorizing communication types between infected devices and command-and-control (C2) infrastructure.
**Origin of Threat Actors:**
– **Language Analysis:** The threat actors are suspected to be Turkish speakers; specific origins remain unidentified.
**Research Insights:**
– While technically reminiscent of existing malware families, DroidBot’s MaaS operational model distinguishes it from typical threats in this category.
**Next Steps:**
– Stay informed on potential impact and mitigation strategies for affected institutions.
– Follow further developments and updates through social media platforms (Twitter, LinkedIn).
### Action Items:
– Monitor for any emerging threats related to DroidBot.
– Evaluate security measures against similar malware attempts.
– Consider organizational training on identifying fake applications.