Bitdefender reveals Mandrake spyware targeting Aussie Android users

guest · Apr 2, 2020

Bitdefender reveals Mandrake spyware targeting Aussie Android users
April 2, 2020
https://www.zdnet.com/article/bitdefender-reveals-mandrake-spyware-targeting-aussie-android-users/

The Bitdefender cybersecurity investigative team has uncovered a new Android spying operation specifically targeting Australian users.
The company found "Mandrake" earlier this year and believe the highly sophisticated spying platform has been active for at least four years.

To date, the team has recorded Mandrake subverting Google Chrome, Gmail, ANZ Australia, Commonwealth Bank of Australia, Bank of Melbourne Mobile Banking, Bank of SA, Australian Super, and PayPal apps.
According to Bitdefender, the criminals are using the software to attack on an individual basis. Mandrake is well developed, with a constant evolution over the four-year timeline of adding new features and solving bugs or dropping functionalities.

"They are human conducted and not automated," Tivadar explained.
Click to expand...

"We saw the attacks are manually orchestrated, this is highly unusual as it seems every victim is analysed independently and an attacker issues commands tailored for him," Tivadar explained. "This also tells us that this cannot be the work of a lone wolf. It would also be possible for them to run some affiliate program, 'selling' victims to others."

"Australia seems to have a very high mobile banking penetration also having a high GDP per capita, might explain why looks so appealing."
Click to expand...

guest · May 14, 2020

Multi-part Android spyware lurked on Google Play Store for 4 years, posing as a bunch of legit-looking apps
May 14, 2020
https://www.theregister.co.uk/2020/05/14/bitdefender_mandrake_malware/

A newly uncovered strain of Android spyware lurked on the Google Play Store disguised as cryptocurrency wallet Coinbase, among other things, for up to four years, according to a new report by Bitdefender.

The malware, named Mandrake by the threat intelligence agency, featured a three-part structure that allowed its operators to evade detection by routine Google scanning.
Beginning with an innocuous-looking dropper hosted on the Google Play store, masquerading as one of a number of legitimate apps, Mandrake allowed its Russian operators to snoop on virtually everything unsuspecting targets did on their mobile phone.

"The crew might be based in either Russia or Kazakhstan," Bogdan Botezatu, director of threat research and reporting at Bitdefender, told The Register.
Click to expand...

Bitdefender traced the Google Play Store developer accounts linked to the droppers and identified a Russian freelance developer, hiding behind a network of fake company websites, stolen identities and email addresses and fake job ads in North America.
Click to expand...

Bitdefender: Mandrake – owning Android devices since 2016

In early 2020 we identified a new, highly sophisticated Android espionage platform that had been active in the wild for at least 4 years. We named the threat Mandrake as the actor(s) behind it used names of toxic plants, or other botanical references, for major development branches: e.g. Briar, Ricinus or Nerium.
An incredibly sophisticated piece of Android malware
Unlike run of the mill malware, Mandrake puts in significant effort NOT to infect victims. It cherry-picks a handful of devices it gets installed on for further exploitation. This is likely because its operators know that they increase their chances of being called out with every device they infect, so they have instructed the malware to avoid countries where compromised devices won’t bring them any return of interest.
Click to expand...

Whitepaper: "Uprooting Mandrake: The Story of an Advanced Android Spyware Framework That Went Undetected for 4 Years"
(PDF - 10.8 MB): https://www.bitdefender.com/files/News/CaseStudies/study/329/Bitdefender-PR-Whitepaper-Mandrake-creat4464-en-EN-interactive.pdf

Log in or Sign up

Bitdefender reveals Mandrake spyware targeting Aussie Android users

guest Guest

guest Guest

Log in or Sign up

Bitdefender reveals Mandrake spyware targeting Aussie Android users

guest Guest

guest Guest

Useful Searches