Operation DISTANTHILL Dismantles Android RAT Fraud Network Tied to $25 Million in Losses
Summary
A Group-IB investigation helped law enforcement dismantle a Southeast Asian network that used fake Android apps and phishing sites to steal banking credentials and defraud victims of more than $25 million. Arrests were made across the region.
Key points
- The operation targeted a network using Android RATs disguised as legitimate apps to steal banking credentials and carry out fraudulent transactions.
- The malware could log keystrokes, capture screenshots, intercept bank OTPs, track device locations and persist after reboots.
- Group-IB identified more than 250 phishing websites and over 100 command-and-control servers linked to the campaigns.
- The operation followed fraud affecting more than 4,000 people; Singapore recorded nearly 2,000 cases in 2023 and losses exceeding $25 million.
- Hong Kong police arrested 14 people, and two alleged masterminds were arrested in Malaysia in a cross-border operation.
- Taiwanese police arrested four people linked to a fake customer service operation and seized $1.33 million in money and cryptocurrency.
- Investigators found at least 260 RAT variants on servers across Hong Kong and other Southeast Asian countries. The malware was offered through a malware-as-a-service scheme.
Article Details
- Event Type
- Joint law-enforcement operation dismantled a cybercriminal network distributing Android RATs through phishing campaigns.
- Impact
- More than 4,000 people were victimized. Singapore recorded nearly 2,000 cases in 2023, with losses exceeding USD 25 million. Authorities arrested suspects in Hong Kong, Malaysia, and Taiwan and seized $1.33 million in money and cryptocurrency in Taiwan.
People
Vendors
Products
Countries
Hong Kongenabled the gang to harvest banking credentials and personal information from victims in Singapore and Hong Kong. After months of investigating, Group-IB uncovered the infrastructure behind the phishing campaigns,Malaysiabuild a complete picture of the attack infrastructure, leading to the arrest of 16 cybercriminals in Malaysia and Hong Kong and several malware operators in Taiwan. The efforts helped prevent further losses andSingaporeapps and enabled the gang to harvest banking credentials and personal information from victims in Singapore and Hong Kong. After months of investigating, Group-IB uncovered the infrastructure behind the phishingTaiwanleading to the arrest of 16 cybercriminals in Malaysia and Hong Kong and several malware operators in Taiwan. The efforts helped prevent further losses and reduce the scale of fraud across the region.