Mexico-Based Hacker Targets Global Banks with Android Malware

An e-crime actor of Mexican provenance has been connected to an Android mobile malware marketing campaign targeting economic institutions globally, but with a certain target on Spanish and Chilean banks, from June 2021 to April 2023.

The exercise is currently being attributed to an actor codenamed Neo_Net, in accordance to security researcher Pol Thill. The conclusions have been printed by SentinelOne adhering to a Malware Analysis Challenge in collaboration with vx-underground.

“Irrespective of applying rather unsophisticated resources, Neo_Net has obtained a superior success level by tailoring their infrastructure to precise targets, resulting in the theft of in excess of 350,000 EUR from victims’ bank accounts and compromising Individually Identifiable Facts (PII) of 1000’s of victims,” Thill explained.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

Some of the main targets include banking companies this kind of as Santander, BBVA, CaixaBank, Deutsche Bank, Crédit Agricole, and ING.

Neo_Net, linked to a Spanish-speaking actor residing in Mexico, has founded by themselves as a seasoned cybercriminal, engaging in the revenue of phishing panels, compromised sufferer info to third-parties, and a smishing-as-a-service supplying known as Ankarex which is intended to goal a number of countries across the entire world.

The initial entry position for the multi-stage attack is SMS phishing, in which the danger actor employs several scare strategies to trick unwitting recipients into clicking on bogus landing webpages to harvest and exfiltrate their credentials by way of a Telegram bot.

“The phishing pages were meticulously established up applying Neo_Net’s panels, PRIV8, and executed numerous protection measures, which include blocking requests from non-mobile consumer agents and concealing the webpages from bots and network scanners,” Thill stated.

“These web pages had been developed to closely resemble real banking applications, full with animations to produce a convincing façade.”

The risk actors have also been noticed duping bank buyers into installing rogue Android applications under the guise of security program that, at the time put in, requests SMS permissions to seize SMS-based mostly two-factor authentication (2FA) codes despatched by the lender.

The Ankarex platform, for its portion, has been lively because Could 2022. It truly is actively promoted on a Telegram channel that has about 1,700 subscribers.

“The service by itself is accessible at ankarex[.]net, and once registered, buyers can upload cash utilizing cryptocurrency transfers and launch their very own Smishing campaigns by specifying the SMS articles and target phone figures,” Thill said.

The development comes as ThreatFabric in-depth a new Anatsa (aka TeaBot) banking trojan marketing campaign that has been concentrating on banking shoppers in the U.S., U.K., Germany, Austria, and Switzerland due to the fact the commence of March 2023.

Identified this report attention-grabbing? Abide by us on Twitter  and LinkedIn to read more special material we put up.