Firestarter Android Malware Abuses Google Firebase Cloud Messaging

guest · Oct 30, 2020

DoNot Group (APT-C-35)
Firestarter Android Malware Abuses Google Firebase Cloud Messaging
The DoNot APT threat group is leveraging the legitimate Google Firebase Cloud Messaging
October 30, 2020
https://threatpost.com/firestarter-android-malware-google-firebase-cloud/160800/

An APT group is starting fires with a new Android malware loader, which uses a legitimate Google messaging service to bypass detection.

The malware, dubbed “Firestarter,” is used by an APT threat group called “DoNot.” DoNot uses Firebase Cloud Messaging (FCM), which is a cross-platform cloud solution for messages and notifications for Android, iOS and web applications. The service is provided by Firebase, a subsidiary of Google, and has been previously leveraged by cybercriminals.

“Our research revealed that DoNot has been experimenting with new techniques to keep a foothold on their victim machines,” according to researchers with Cisco Talos in a Thursday analysis.
Click to expand...

“DoNot team is hiding part of their traffic among legitimate traffic,” said researchers.

The final payload, meanwhile, is not embedded in the Android application, making it impossible for analysts to dissect it.

“This approach also makes detection more difficult,” they said. “The application is a loader with a fake user interface that manipulates the target after installing it.”
Click to expand...

Cisco Talos: DoNot’s Firestarter abuses Google Firebase Cloud Messaging to spread

The newly discovered Firestarter malware uses Google Firebase Cloud Messaging to notify its authors of the final payload location.

Even if the command and control (C2) is taken down, the DoNot team can still redirect the malware to another C2 using Google infrastructure.

The approach in the final payload upload denotes a highly personalized targeting policy.

Click to expand...

Log in or Sign up

Firestarter Android Malware Abuses Google Firebase Cloud Messaging

guest Guest

Log in or Sign up

Firestarter Android Malware Abuses Google Firebase Cloud Messaging

guest Guest

Useful Searches