Mexico-Based Hacker Targets Global Banks with Android Malware

An e-criminal offense actor of Mexican provenance has been connected to an Android cellular malware campaign targeting economical establishments globally, but with a specific focus on Spanish and Chilean financial institutions, from June 2021 to April 2023.

The activity is staying attributed to an actor codenamed Neo_Net, according to security researcher Pol Thill. The conclusions were published by SentinelOne following a Malware Research Challenge in collaboration with vx-underground.

“Even with applying reasonably unsophisticated equipment, Neo_Net has obtained a superior good results fee by tailoring their infrastructure to precise targets, resulting in the theft of around 350,000 EUR from victims’ lender accounts and compromising Individually Identifiable Data (PII) of hundreds of victims,” Thill reported.

Some of the important targets contain banking institutions these kinds of as Santander, BBVA, CaixaBank, Deutsche Bank, Crédit Agricole, and ING.

Neo_Net, linked to a Spanish-speaking actor residing in Mexico, has recognized themselves as a seasoned cybercriminal, engaging in the sales of phishing panels, compromised target info to 3rd-events, and a smishing-as-a-services supplying termed Ankarex which is created to goal a range of international locations across the earth.

The preliminary entry point for the multi-phase attack is SMS phishing, in which the menace actor employs several scare ways to trick unwitting recipients into clicking on bogus landing internet pages to harvest and exfiltrate their qualifications by means of a Telegram bot.

“The phishing web pages have been meticulously set up employing Neo_Net’s panels, PRIV8, and executed many defense actions, which include blocking requests from non-mobile consumer agents and concealing the webpages from bots and network scanners,” Thill spelled out.

“These web pages were built to carefully resemble genuine banking programs, finish with animations to produce a convincing façade.”

The risk actors have also been noticed duping financial institution clients into setting up rogue Android applications beneath the guise of security program that, after put in, requests SMS permissions to seize SMS-based mostly two-element authentication (2FA) codes sent by the lender.

The Ankarex platform, for its element, has been lively given that May 2022. It truly is actively promoted on a Telegram channel that has about 1,700 subscribers.

“The service alone is obtainable at ankarex[.]net, and after registered, customers can add funds making use of cryptocurrency transfers and start their very own Smishing strategies by specifying the SMS content material and target phone quantities,” Thill explained.

The progress comes as ThreatFabric specific a new Anatsa (aka TeaBot) banking trojan campaign that has been targeting banking buyers in the U.S., U.K., Germany, Austria, and Switzerland since the start out of March 2023.

Uncovered this write-up fascinating? Adhere to us on Twitter  and LinkedIn to read additional special written content we publish.

Some parts of this article are sourced from:
thehackernews.com