A new Android remote access trojan (RAT) called DroidBot has been identified targeting 77 banking institutions, cryptocurrency exchanges, and national organizations. This RAT combines hidden VNC and overlay attack techniques with spyware-like capabilities such as keylogging and user interface monitoring. It also utilizes dual-channel communication, transmitting outbound data through MQTT and receiving inbound commands via HTTPS for enhanced operation flexibility and resilience.
Discovered by Cleafy researchers in late October 2024, DroidBot has been operating under a malware-as-a-service (MaaS) model, charging a monthly fee of $3,000. The malware has attracted 17 affiliate groups who pay for access to the offering, allowing them to modify configurations, create custom APK files, and interact with infected devices by issuing commands. The campaigns have been observed primarily in countries like Austria, Belgium, France, Italy, Portugal, Spain, Turkey, and the United Kingdom.
DroidBot disguises malicious apps as generic security applications, Google Chrome, or popular banking apps to deceive users. It heavily relies on Android’s accessibility services to harvest sensitive data and remotely control devices, distinguishing itself by using two different protocols for command-and-control (C2). Inbound commands are sent over HTTPS, while outbound data is transmitted using the messaging protocol MQTT.
The researchers noted that while DroidBot may not be technically groundbreaking, its operational model closely resembles a MaaS scheme, which is uncommon in this type of threat. The threat actors behind this operation are believed to be Turkish speakers based on an analysis of the malware samples. The MQTT broker used by DroidBot organizes specific communication topics between infected devices and the C2 infrastructure, enhancing operational flexibility and resilience.
The discovery of DroidBot highlights the evolving landscape of mobile security threats, emphasizing the importance of staying vigilant and implementing robust security measures to protect against such sophisticated malware.
Source link