TipTop Android Malware Group Infected 800,000 Phones Before Members Were Arrested
Summary
Group-IB says the TipTop group used fake Android apps and banking Trojans from 2015 to 2019 to steal from Russian bank customers. A coordinated operation led to arrests and prosecutions of group members.
Key points
- TipTop targeted Android customers of major Russian banks and infected more than 800,000 smartphones.
- The group spread Trojans through fake apps promoted on rogue or compromised websites, including sites advertised in search results.
- Its malware could intercept SMS messages, access contacts, make calls and USSD requests, and hide messages or calls.
- The group used SMS and USSD data, web injects, and phishing screens to obtain banking details and steal funds.
- TipTop used several Trojan families, including Hqwar, Honli, Asacub.g, CatsElite, LokiBot, and Marcher.
- Russian police arrested members in 2019 following a coordinated investigation with Group-IB; members were prosecuted under Russian law.
Article Details
- Attack Vectors
- Distributed Android banking Trojans disguised as popular apps, including banking apps, messengers, a graphic design application, Minecraft, and a fake Google Play store app.
- Placed download links on attacker-created rogue websites or legitimate web resources they had compromised; promoted the sites through search-engine ads for the keyword “mobile bank”.
- Used SMS parsing, USSD requests, mobile banking commands, and auto-reply features to gather account information and transfer victims’ money.
- Used bank-specific web injects and phishing dialogues to steal online-banking credentials and payment-card data.
- Defensive Notes
- The article reports that coordinated law-enforcement operations and Group-IB’s investigation led to arrests of TipTop members.
- The article does not provide specific technical detection or mitigation guidance.
MITRE ATT&CK
T1411The Android Trojans intercepted and read victims’ SMS messages.T1412The Trojans stole credit-card data and online-banking credentials using phishing dialogues and bank-specific web injects.T1417The article says the Trojans recorded phone calls.T1433The Trojans collected contact-list information from infected devices.T1437The Trojans sent USSD requests and used mobile banking commands to transfer money from victims’ accounts.T1476The group distributed Android Trojans disguised as popular mobile apps, including banking apps and a fake Google Play store app.
People
Threat Actors
Malware
Agent.BIDThe group started their activities with the Hqwar Android banking Trojan (also known as Agent.BID).Asacub.gIn 2016, they started using the Honli Trojan, and in February 2016 they adopted an upgraded version of it, which anti-virus systems tracked as Asacub.g.CatsEliteDuring the same period, TipTop used the CatsElite (MarsElite) Trojan.CronAfter the fall of the Cron gang in late 2016, the group dubbed TipTop by Group-IB became one of the largest and most dangerous ones on the Russian cybercrime market. Using Android Trojans, the cybercriminals infectedHonliIn 2016, they started using the Honli Trojan, and in February 2016 they adopted an upgraded version of it, which anti-virus systems tracked as Asacub.g.HqwarThe group started their activities with the Hqwar Android banking Trojan (also known as Agent.BID).LokiBotIn April 2017, they returned to Hqware (Agent.BID) but also used LokiBot and an upgraded version of the old Marcher (Rahunok) Trojan.MarcherIn April 2017, they returned to Hqware (Agent.BID) but also used LokiBot and an upgraded version of the old Marcher (Rahunok) Trojan.MarsEliteDuring the same period, TipTop used the CatsElite (MarsElite) Trojan.RahunokIn April 2017, they returned to Hqware (Agent.BID) but also used LokiBot and an upgraded version of the old Marcher (Rahunok) Trojan.
Vendors
Products
Androidby Group-IB became one of the largest and most dangerous ones on the Russian cybercrime market. Using Android Trojans, the cybercriminals infected over 800,000 smartphones and created a giant botnet. Their ultimateGoogle Playfake mobile apps disguised as banking apps, messengers, Adobe’s graphic design application, and a fake Google Play store app. The hackers placed links to the fake apps either on rogue websites they had designedMinecraftIn this case, the Trojan was made to look like dating apps, the Google Play store, and even Minecraft.
Countries
Germanythe group’s command-and-control (C&C) servers and websites used to infect the devices were located in Germany, USA, and Ukraine.RussiaDue to stricter legislation and intensified efforts to fight against this type of threat in Russia (including arrests of key botnet masterminds), cybercriminals found it increasingly less profitable to attack victims inUkraine(C&C) servers and websites used to infect the devices were located in Germany, USA, and Ukraine.USAgroup’s command-and-control (C&C) servers and websites used to infect the devices were located in Germany, USA, and Ukraine.