Android malware vendor teams with marketer to promote new malware

Rogue malware can take over devices and exfiltrate data, warns researchers

Red skull and crossbones atop binary code

Security researchers have uncovered a scheme by a malware author to team up with a developer and marketer to promote a new type of Android malware called Rogue. 

According to a blog post by Check Point Research, Rogue can perform device takeover and data exfiltration,  and it’s for sale on the dark net. Triangulum, a dark net vendor, teamed up with HeXaGoN Dev to introduce the new malware.

Researchers said the first sign of Triangulum came in 2017, when it launched a mobile RAT capable of data exfiltration from C&C servers and deleting local data and, in some cases, entire operating systems. Four months later, Triangulum offered its first Android malware for sale.

Triangulum then disappeared for nearly 18 months and showed no signs of activity on the dark net. It then resurfaced on April 6, 2019 with a new product for sale. Researchers said that from this point on, Triangulum has been very active, advertising a number of products over the next six months.

Researchers speculate that during Triangulum’s hiatus from the dark net, it collaborated with another threat actor, HexaGoN Dev, to create a high-functioning production line for developing and distributing Android malware.

Rogue is part of the MRAT family (Mobile Remote Access Trojan), which gains control of the host device and exfiltrates any kind of data, modifies files on an Android device, and downloads additional malicious payloads. 

When Rogue successfully gains all the required permissions on the targeted device, it hides its icon from the device’s user to ensure it won’t be easy to get rid of it. If the user doesn’t grant all the required permissions, it’ll repeatedly ask.

HexaGoN Dev, which specializes in developing Android OS malware products, particularly RATs, partnered with Triangulum to help it sell its malware, which it’s struggled to do on its own. HexaGoN Dev helped Triangulum create different brandings for exactly the same product

“In the past, Triangulum had purchased several projects created by HeXaGoN Dev. The combination of HeXaGon Dev’s programming skills and Triangulum’s social marketing skills clearly posed a legitimate threat,” said researchers.

Yaniv Balmas, head of cyber research at Check Point, said research showed how difficult it is to track, classify, and protect against new malware in an effective way, because it’s easy for malware authors to create fake products, which may confuse security vendors.

“While we have ways of detecting such things in the real-world, the underground market is still like the wild west, which makes it very hard to quickly establish what is a real and dangerous threat and what isn’t,” he said.

Featured Resources

The ultimate law enforcement agency guide to going mobile

Best practices for implementing a mobile device program

Free download

The business value of Red Hat OpenShift

Platform cost savings, ROI, and the challenges and opportunities of Red Hat OpenShift

Free download

Managing security and risk across the IT supply chain: A practical approach

Best practices for IT supply chain security

Free download

Digital remote monitoring and dispatch services’ impact on edge computing and data centres

Seven trends redefining remote monitoring and field service dispatch service requirements

Free download

Recommended

Microsoft shares more details about Android apps in Windows 11
Microsoft Windows

Microsoft shares more details about Android apps in Windows 11

20 Oct 2021
Almost 70% of CISOs expect a ransomware attack
ransomware

Almost 70% of CISOs expect a ransomware attack

19 Oct 2021
Organizations warned of ransomware risk from smaller operators
ransomware

Organizations warned of ransomware risk from smaller operators

19 Oct 2021
MirrorBlast phishing campaign targets financial companies
phishing

MirrorBlast phishing campaign targets financial companies

15 Oct 2021

Most Popular

Alibaba unveils custom Arm-based server chip
components

Alibaba unveils custom Arm-based server chip

19 Oct 2021
Windows 11 has problems with Oracle VirtualBox
Microsoft Windows

Windows 11 has problems with Oracle VirtualBox

5 Oct 2021
What is cyber warfare?
Security

What is cyber warfare?

15 Oct 2021