Reich 5 Android Malware Gang Stole $930,000 Before Members Were Arrested
Summary
The Reich 5 gang used Svpeng Android malware to steal banking credentials and intercept SMS codes, taking more than 50 million rubles from over 30,000 bank clients before Russian authorities arrested four members in 2015.
Key points
- The Svpeng Trojan spread through SMS links disguised as Adobe Flash Player updates and requested administrator privileges.
- The malware hid bank SMS notifications and overlaid fake Google Play and banking screens to steal card details and online banking credentials.
- Attackers used stolen credentials and intercepted SMS confirmation codes to make unauthorized transfers.
- The campaign stole more than 50 million rubles, reported as about $930,000, from over 30,000 bank clients; the malware infected more than 340,000 Android devices.
- Stolen funds were routed through money mules, who withdrew cash from accounts opened in their own names.
- Group-IB worked with affected banks and Russian law enforcement to identify the group; authorities arrested four members in April 2015, including the Svpeng lead developer.
Article Details
- Victim Organization
- Unknown
- Incident Type
- Android banking Trojan campaign involving credential and payment-card data theft, SMS interception, and fraudulent bank transfers
- Data Types Exposed
- Bank card details, including card number, cardholder information, expiration date, and CVV code
- Online banking login credentials
- Bank SMS notifications and confirmation codes
- Affected Records
- More than 30,000 bank clients were affected by theft; the malware infected over 340,000 Android devices.
- Operational Impact
- More than 50 million rubles ($930,000) was stolen from bank clients. Russian law enforcement detained four Reich 5 members in April 2015, and the article says the operation helped prevent further losses.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
People
Threat Actors
Malware
Vendors
Products
Adobe Flash PlayerThe group spread malware through SMS messages in which the download link was made to look like an Adobe Flash Player update, intercepting users’ banking SMS notifications and authorizing fraudulent transactions withoutAndroidinstitutions and their customers. Cybercriminals increasingly targeted mobile platforms, especially Android, which presented new vulnerabilities and fewer security controls than traditional desktop environments.Google PayGroup-IB examined their smartphones and found that a malicious mobile application had replaced the Google Pay interface on the device screen with an identical fake. When the device owner entered their bank cardGoogle PlayOnce the malicious program infected a mobile device, it checked if the Google Play app was running.
Countries
Russiawhich presented new vulnerabilities and fewer security controls than traditional desktop environments. In Russia and other CIS countries, financial institutions and individual users faced an unprecedented wave ofUkraineAgainst this backdrop, Group-IB identified Reich 5, a cybercriminal network in Russia and Ukraine that epitomized the evolution of cybercrime tactics during this period.