Godfather Trojan Targets 400 Financial Services Firms

People of hundreds of banking apps, cryptocurrency wallets and crypto-exchanges have been focused by a prolific cellular banking Trojan because at minimum June 2021, according to Team-IB.

The Singapore-centered security vendor claimed in a new report that, as of October 2022, the Trojan had targeted 215 world wide financial institutions, 94 cryptocurrency wallets and 110 crypto-trade platforms.

Most of these companies are in the US, Turkey, Spain, Canada, Germany, France and the UK. Curiously, none are located in former Soviet countries, hinting that the perpetrators may well be Russian.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

The malware by itself is concealed in legitimate-hunting applications on Google Participate in, with the payload spoofed to surface as if it truly is Google Defend. It’s based mostly on an aged piece of banking Trojan malware regarded as Anubis, which has been modernized to contain a different C&C communication protocol, traffic encryption algorithm and other attributes.

It also removed some of the outdated functionality in Anubis such as file encryption, recording audio and receiving GPS facts, Group-IB reported.

When a person interacts with a decoy notification or attempts to open a person of the legit apps focused by Godfather, the malware reveals them a “web fake” overlay, which harvests usernames and passwords, as effectively as SMS-centered two-factor authentication codes.

The malware also has the potential to start keyloggers and file the victim’s system monitor if vital, to get the identical details, the report described.

Team-IB claimed that intelligence gleaned from a Telegram channel implies Godfather is remaining dispersed via malware-as-a-services product.

“By imitating Google Defend, Godfather can very easily go undetected on contaminated devices. Unwitting people believe that they are remaining shielded by an Android company, but in truth, the malicious actors achieve access to their banking and financial portal accounts,” the security seller concluded.

“While Team-IB does not have definitive data on the amount of money of dollars stolen by operators of Godfather, the procedures harnessed by malicious actors are cause for worry.”