Cron Android Banking Gang Infected Over One Million Devices Before Arrests
Summary
Group-IB details how the Cron group used Android banking Trojans to steal more than $800,000, infect over one million devices, and target customers of 50 Russian banks before law enforcement arrested its members.
Key points
- Cron malware spread through SMS links and fake apps disguised as legitimate applications.
- The Trojan forwarded and intercepted SMS messages, including bank confirmation codes, enabling fraudulent transactions.
- The group infected as many as 3,500 devices per day and targeted customers of 50 Russian banks.
- Investigators say Cron stole more than $800,000 and opened over 6,000 bank accounts to cash out stolen funds.
- In 2016, the group rented the Tiny.z (MarsElite) Trojan and prepared attacks on banks in France and other countries.
- Russian law enforcement arrested 16 members in November 2016; the last active member was caught in April 2017, and the group has not attacked since.
Article Details
- Attack Vectors
- Spam SMS messages used social-engineering claims about posted ads or photos to direct recipients to websites that prompted them to download and install malicious apps.
- Fake Android applications disguised as legitimate apps, including Viber, Google Play, Navitel, Framaroot, Pornhub, and Avito, delivered the malware.
- After installation, the malware added itself to auto-start, sent SMS messages to criminally specified numbers, forwarded victims’ SMS messages to C&C servers, and intercepted bank confirmation codes.
- The Trojan automatically transferred money from infected users’ bank accounts to money mule accounts.
- Defensive Notes
- Group-IB and Russian law enforcement identified and arrested members of the Cron group; the article reports that its last active member was apprehended in April 2017 and that the group conducted no further attacks or thefts.
MITRE ATT&CK
T1036 · MasqueradingCron malware was distributed in fake applications disguised as legitimate apps such as Viber, Google Play, Navitel, Framaroot, Pornhub, and Avito.T1056.003 · Web Portal CaptureTiny.z displayed a universal overlay window prompting users to enter personal data while presenting the icon and name of a banking app.T1098 · Account ManipulationThe group opened more than 6,000 bank accounts to cash out stolen money.T1111 · Multi-Factor Authentication InterceptionThe malware intercepted bank SMS confirmation codes used to authorize transactions.T1204.001 · Malicious LinkVictims were tricked by SMS-linked websites into downloading and installing malicious apps.T1531 · Account Access RemovalThe malware transferred money from victims’ bank accounts to money mule accounts.T1547.001 · Registry Run Keys / Startup FolderAfter installation, the app added itself to auto-start on the victim’s phone.T1583 · Acquire InfrastructureCron rented access to Tiny.z (aka MarsElite) through underground forums for its planned international expansion.
Threat Actors
Malware
Cron BotGroup-IB first learnt about Cron in March 2015, when the criminal gang was spreading Cron Bot malware disguised as Viber and Google Play apps. Back then, Group-IB’s Threat Intelligence began tracking a new cybercriminalMarsEliteTo do so, in June 2016 the gang rented access to a more powerful mobile banking Trojan, Tiny.z (aka MarsElite), which was offered for $2,000 per month on underground forums. This universal tool could attack AndroidTiny.zexpand worldwide. To do so, in June 2016 the gang rented access to a more powerful mobile banking Trojan, Tiny.z (aka MarsElite), which was offered for $2,000 per month on underground forums. This universal tool could
Vendors
Products
AndroidThreat actors targeted Android with mobile malware more and more often due to its widespread use (85% of device users) and the popularity of mobile banking in Russia.Assurance BanqueThey developed special web injections for the following French financial institutions: Credit Agricole, Assurance Banque, Banque Populaire, BNP Paribas, Boursorama, Caisse d’Epargne, Societe Generale, and LCL.AvitoThe Trojan was spread by being made to look like applications such as Navitel, Framaroot, Pornhub, and Avito.Banque PopulaireThey developed special web injections for the following French financial institutions: Credit Agricole, Assurance Banque, Banque Populaire, BNP Paribas, Boursorama, Caisse d’Epargne, Societe Generale, and LCL.BNP ParibasThey developed special web injections for the following French financial institutions: Credit Agricole, Assurance Banque, Banque Populaire, BNP Paribas, Boursorama, Caisse d’Epargne, Societe Generale, and LCL.BoursoramaThey developed special web injections for the following French financial institutions: Credit Agricole, Assurance Banque, Banque Populaire, BNP Paribas, Boursorama, Caisse d’Epargne, Societe Generale, and LCL.Caisse d’EpargneThey developed special web injections for the following French financial institutions: Credit Agricole, Assurance Banque, Banque Populaire, BNP Paribas, Boursorama, Caisse d’Epargne, Societe Generale, and LCL.Credit AgricoleThey developed special web injections for the following French financial institutions: Credit Agricole, Assurance Banque, Banque Populaire, BNP Paribas, Boursorama, Caisse d’Epargne, Societe Generale, and LCL.FramarootThe Trojan was spread by being made to look like applications such as Navitel, Framaroot, Pornhub, and Avito.Google Playabout Cron in March 2015, when the criminal gang was spreading Cron Bot malware disguised as Viber and Google Play apps. Back then, Group-IB’s Threat Intelligence began tracking a new cybercriminal group distributingLCLThey developed special web injections for the following French financial institutions: Credit Agricole, Assurance Banque, Banque Populaire, BNP Paribas, Boursorama, Caisse d’Epargne, Societe Generale, and LCL.NavitelThe Trojan was spread by being made to look like applications such as Navitel, Framaroot, Pornhub, and Avito.PornhubThe Trojan was spread by being made to look like applications such as Navitel, Framaroot, Pornhub, and Avito.Societe GeneraleThey developed special web injections for the following French financial institutions: Credit Agricole, Assurance Banque, Banque Populaire, BNP Paribas, Boursorama, Caisse d’Epargne, Societe Generale, and LCL.Viberfirst learnt about Cron in March 2015, when the criminal gang was spreading Cron Bot malware disguised as Viber and Google Play apps. Back then, Group-IB’s Threat Intelligence began tracking a new cybercriminal group
Countries
AustraliaThe authors tailored the malware to be used for attacks on banks in the United Kingdom, Germany, France, the USA, Turkey, Singapore, Australia, and others.FranceThe authors tailored the malware to be used for attacks on banks in the United Kingdom, Germany, France, the USA, Turkey, Singapore, Australia, and others.GermanyThe authors tailored the malware to be used for attacks on banks in the United Kingdom, Germany, France, the USA, Turkey, Singapore, Australia, and others.RussiaThreat actors targeted Android with mobile malware more and more often due to its widespread use (85% of device users) and the popularity of mobile banking in Russia.SingaporeThe authors tailored the malware to be used for attacks on banks in the United Kingdom, Germany, France, the USA, Turkey, Singapore, Australia, and others.TurkeyThe authors tailored the malware to be used for attacks on banks in the United Kingdom, Germany, France, the USA, Turkey, Singapore, Australia, and others.United KingdomThe authors tailored the malware to be used for attacks on banks in the United Kingdom, Germany, France, the USA, Turkey, Singapore, Australia, and others.USAThe authors tailored the malware to be used for attacks on banks in the United Kingdom, Germany, France, the USA, Turkey, Singapore, Australia, and others.