loader image
Filters
Search
Categories

Android Malware Targets Central Asian Banks with 2FA Interception

by | Sep 20, 2024 | Cybersecurity

Key Takeaways

BLUF

Ajina.Banker is a new strain of Android malware targeting bank customers in Central Asia. It harvests financial data and intercepts 2FA messages, primarily spreading via Telegram channels disguised as legitimate apps for banking, payments, and utilities. The malware has been active since November 2023.

Key Takeaways

  1. Target Regions: Armenia, Azerbaijan, Iceland, Kazakhstan, Kyrgyzstan, Pakistan, Russia, Tajikistan, Ukraine, and Uzbekistan.
  2. Discovery: Found by Singapore-based Group-IB in May 2024.
  3. Main Goal: Harvest financial data and intercept 2FA messages.
  4. Malware Propagation: Through Telegram channels posing as legitimate apps or services.
  5. Distribution Tactics:

   – Use of themed messages tailored to local interests.

   – Abuse of Telegram trust for evading bans.

   – Sharing malicious files as promotions or giveaways.

  1. Automation: Aspects of the Telegram-based malware distribution process may be automated.
  2. Malware Capabilities:

   – Collecting SIM card info, SMS messages, financial app details.

   – Exfiltrating data to remote servers.

   – Serving phishing pages to steal banking info.

   – Abusing Android’s accessibility services to prevent uninstallation.

  1. Affiliates: Spread by a network of financially motivated affiliates.
  2. Coordination: Use of multiple accounts and automation for bombarding targets.
  3. Active Development: Hiring of Java coders for development and expansion of the tool.
  4. Links to Other Malware: Possible connection with SpyNote and Gigabud families.
  5. Cultural Familiarity: Attackers seem familiar with the region they are targeting.

Source: The Hacker News

Android Malware Targets Central Asian Banks with 2FA Interception

by | Sep 20, 2024 | Cybersecurity

[ i2 ] REPOSITORY

 

Generative AI Accelerates Malware Development For Cross-Platform Attacks

Hackers are increasingly turning to generative artificial intelligence (AI) technology to craft sophisticated malware and phishing attacks targeting individuals and organizations alike. A recent discovery of a malware campaign by HP Wolf Security involved the AsyncRAT malware delivered through AI-generated code. The attackers used HTML smuggling techniques to deliver password-protected ZIP archives, which, once cracked, unleashed scripts establishing persistence on infected machines. The organized structure and explanatory comments in the code resembled outputs of generative AI. Researchers noted that generative AI allows even less-skilled hackers to develop advanced malware quickly. The malware campaign also demonstrated how attackers used generative AI not only for writing code but also for speeding up their workflow in developing threats targeting different platforms. Additionally, archives were reported as the most common delivery method in the first half of 2024.

New Chinese Kamikaze Drone Surpasses U.S. Rivals With Longer Range Speed

China unveiled the PD-2900, a large twin-engine kamikaze drone with Russian camouflage capable of reaching Taiwan. It features advanced technology, a 2,500-km range, and a 100-kg payload capacity. The unmanned aerial vehicle (UAV), which resembles drones used in the Russia-Ukraine war, offers a more affordable alternative to cruise missiles. Developed by Xian Modern Control Technology Institute under Norinco, a Chinese company, the drone is faster, has a longer range, and can hover over targets, surpassing its U.S. counterpart, the Switchblade 600. This development could impact the balance of drone warfare in the region surrounding Taiwan.

North Korea Fires Missiles After Flying Balloons Toward South Korea

North Korea launched multiple short-range ballistic missiles following Kim Jong Un’s pledge to enhance the country’s nuclear readiness. The missiles, which traveled 360 kilometers, landed between the Korean Peninsula and Japan, marking the first such test in over two months. The launch drew condemnation from South Korea, Japan, and the U.S., who reaffirmed their security commitments. This escalation has sparked speculation of a potential nuclear or long-range missile test, though recent satellite images show no activity at North Korea’s nuclear test site. The launch follows increased tensions, including North Korea sending balloons filled with rubbish toward South Korea.

Taiwan’s Arms Backlog Partly Caused by the Middle East

U.S. Representative Mike Gallagher raises concerns regarding the pace of arms deliveries to Taiwan and proposes redirecting resources from arms transfers to large Middle Eastern buyers to expedite Taiwan’s defense preparedness, along with increased investment in Taiwan’s indigenous defense industry.

Shortage of Engineers Threatens Taiwan’s Dominance in Semiconductor Manufacturing

Taiwan Semiconductor Manufacturing Company (TSMC) faces a talent crisis as Taiwan’s shrinking population, demanding work culture, and competing tech jobs pose challenges in sustaining the demand for skilled engineers. TSMC’s dominance in microchips has geopolitical significance for Taiwan, but it must compete with other industries and global firms for talent.

Indonesia’s dilemma over China’s Global Security Initiative

Indonesia should use its time as ASEAN chair in 2023 to invigorate the more inclusive dialogue-based regional security architecture that better suits regional principles and values. This includes the ‘ASEAN for ASEAN’ vision, the ASEAN Outlook in Indo-Pacific, and forums including the East Asia Summit, which can accommodate the interests of all members. Adding another concept, such as China’s Global Security Initiative, should not be a priority.

France and Japan sign nuclear cooperation agreement to deepen ties in next-generation nuclear research

France and Japan signed a joint declaration to deepen ties in the research and development of next-generation nuclear such as sodium-cooled fast reactors. The declaration also pledges to continue work on the safe life extension of existing reactors, decommissioning of nuclear plants, developing civil nuclear capacity in interested countries, and promoting the recycling of used nuclear fuel to minimize the need for uranium.

How the Chinese Communist Party is using WeChat to shape public policy in the U.S.

The Chinese Communist Party is using WeChat to shape public policy outcomes in the United States. Efforts by the CCP to mobilize Chinese speakers to oppose legislation have been successful in Texas and Florida, where bills have been introduced to ban governments, companies, and citizens of China, Russia, Iran, and North Korea from purchasing land near strategic sites.

Android Malware Targets Central Asian Banks with 2FA Interception

by | Sep 20, 2024 | Cybersecurity

Key Takeaways

BLUF

Ajina.Banker is a new strain of Android malware targeting bank customers in Central Asia. It harvests financial data and intercepts 2FA messages, primarily spreading via Telegram channels disguised as legitimate apps for banking, payments, and utilities. The malware has been active since November 2023.

Key Takeaways

  1. Target Regions: Armenia, Azerbaijan, Iceland, Kazakhstan, Kyrgyzstan, Pakistan, Russia, Tajikistan, Ukraine, and Uzbekistan.
  2. Discovery: Found by Singapore-based Group-IB in May 2024.
  3. Main Goal: Harvest financial data and intercept 2FA messages.
  4. Malware Propagation: Through Telegram channels posing as legitimate apps or services.
  5. Distribution Tactics:

   – Use of themed messages tailored to local interests.

   – Abuse of Telegram trust for evading bans.

   – Sharing malicious files as promotions or giveaways.

  1. Automation: Aspects of the Telegram-based malware distribution process may be automated.
  2. Malware Capabilities:

   – Collecting SIM card info, SMS messages, financial app details.

   – Exfiltrating data to remote servers.

   – Serving phishing pages to steal banking info.

   – Abusing Android’s accessibility services to prevent uninstallation.

  1. Affiliates: Spread by a network of financially motivated affiliates.
  2. Coordination: Use of multiple accounts and automation for bombarding targets.
  3. Active Development: Hiring of Java coders for development and expansion of the tool.
  4. Links to Other Malware: Possible connection with SpyNote and Gigabud families.
  5. Cultural Familiarity: Attackers seem familiar with the region they are targeting.

Source: The Hacker News