Virus Bulletin 2019: Geost Android Botnet Goes After Millions of Euros

guest · Oct 2, 2019

Virus Bulletin 2019: Geost Android Botnet Goes After Millions of Euros
Bad OpSec led to the botnet’s discovery — revealing 800,000 victims in Russia
October 2, 2019
https://threatpost.com/virus-bulletin-geost-android-botnet/148864/

A powerful Android botnet dubbed Geost has been spotted targeting Russian citizens, with the end goal of distributing a banking trojan to victims.

The botnet has infected more than 800,000 Android devices, controlling several million Euros held in five banks, according to researchers from Czech Technical University, UNCUYO University and Avast that discovered the botnet.

“A rare chain of OpSec mistakes lead to the discovery of a new Android banking botnet,” according to the research, presented at Virus Bulletin 2019 in London on Wednesday. “The unusual discovery was made when the botmasters decided to trust a malicious proxy network built by a malware called HtBot. The HtBot malware provides a proxy service that can be rented to give users a pseudo-anonymous communication to the internet. [...]"
Adding insult to injury, Geost’s botmasters also failed to encrypt their communications, giving researchers a direct view into the adversaries’ internal workings.
Propagation and Reach
The Geost botnet consists of infected Android phones, which are victimized by the botnet via malicious, fake applications. These include fake banking apps and fake social networks. Once infected the phones connect to the botnet and are remotely controlled.
Click to expand...

Virus Bulletin: Geost botnet. The discovery story of a new Android banking trojan from an OpSec error

Beyonder · Oct 2, 2019

It's almost like Google should do something about the wild west when it comes to updates on Android devices, once and for all.

guest · Oct 21, 2019

VB2019 paper: Geost botnet. The story of the discovery of a new Android banking trojan from an OpSec error
October 21, 2019
https://www.virusbulletin.com/blog/...overy-new-android-banking-trojan-opsec-error/

OpSec mistakes are what lead to many malware discoveries, but in the case of the Geost Android botnet the mistake was a really interesting one: its operators were using another botnet, HtBot, to manage infected devices, not realising that researchers were analysing some HtBot-infected hosts.
This led researchers Sebastian García, Maria Jose Erquiaga and Anna Shirokova to the discovery of Geost, a large Android botnet mostly targeting users of online banking in Russia.

Today we publish the researchers' paper on Geost in both HTML and PDF format. We have also uploaded the video of Sebastian and Anna presenting at VB2019 in London to our YouTube channel.
Click to expand...

Research paper: (PDF - 1.29 MB): https://www.virusbulletin.com/uploads/pdf/magazine/2019/VB2019-Garcia-etal.pdf

Log in or Sign up

Virus Bulletin 2019: Geost Android Botnet Goes After Millions of Euros

guest Guest

Beyonder Registered Member

guest Guest

Log in or Sign up

Virus Bulletin 2019: Geost Android Botnet Goes After Millions of Euros

guest Guest

Beyonder Registered Member

guest Guest

Useful Searches