Saturday, July 13, 2024

Switcher – Android Malware Seize Routers’s DNS Settings

Switcher – Android Malware Seize Routers’s DNS Settings: A new Android Trojan was identified by malware researchers at Kaspersky Lab’s.

This trojan is bit special instead of attacking the user, it attacks the wireless router that user is connected to and execute a DNS Robbery attack.

Malware AndroidOS Switcher, carry out a brute force attack on the router’s admin panel if the attacks succeeded then the malware can change the IP address of the DNS servers in the router.

By Changing the DNS servers attackers can re-route the traffic to servers operated by cyber criminals. This process of overthrow is referred as DNS-hijacking.

How Switcher Performs Its Brute-force Attacks

As per Kaspersky lab’s to date, they have identified two versions of trojans.

acdb7bfebf04affd227c93c97df536cf; package name –
64490fbecefa3fcdacd41995887fe510; package name – com.snda.wifi

The first version (, impersonate itself as a mobile client for the Chinese search engine Baidu, simply opening a URL inside the application.

The second version is a well-made imitation of a popular Chinese app ( for sharing information about Wi-Fi networks (including the security password) between users of the app.

Cyber criminals even created a website (though badly made) to advertise and distribute the aforementioned fake version of com.snda.wifilocating. The web server that hosts the site is also used by the malware authors as the command-and-control (C&C) server.

Switcher - Android Malware Seize Routers's DNS SettingsInfection Process Secrets Revealed

  • Trojan gets the Wireless access point of the network and informs the command and control server that the trojan is being activated in a network with this Wireless access point.
  • Then it tries to get the name of the ISP (Internet Service Provider) and uses that to determine which rogue DNS server will be used for DNS-hijacking.
  • There are three possible DNS servers –, and; with being the default choice, while the others will be chosen only for specific ISPs.
  • Launches a brute-force attack with the following predefined dictionary of logins and passwords:

admin:00000000, admin:admin, admin:123456, admin:12345678, admin:123456789, admin:1234567890, admin:66668888, admin:1111111, admin:88888888, admin:666666, admin:87654321, admin:147258369, admin:987654321, admin:66666666, admin:112233, admin:888888, admin:000000, admin:5201314, admin:789456123, admin:123123, admin:789456123, admin:0123456789, admin:123456789, admin:11223344, admin:123123123.

  • If this brute force attempt with admin interface is successful, the trojan navigates to the WAN settings and exchanges the primary DNS server for a rogue DNS controlled by the cyber criminals, and a secondary DNS with (the Google DNS, to ensure ongoing stability if the rogue DNS goes down).
Switcher - Android Malware Seize Routers's DNS Settings
Switcher - Android Malware Seize Routers's DNS Settings
  • If the accomplishment successful with DNS addresses, the trojan report its success to the command-and-control (C&C) server.

One Word: Why It Is Bad

The domain name system (DNS) maps internet domain names to the internet protocol(IP).

Cybercriminals change the victim’s (which in our case is the router) TCP/IP settings to force it to make DNS queries to a DNS server controlled by them – a rogue DNS server.

Switcher - Android Malware Seize Routers's DNS Settings

You may ask – why does it matter: routers don’t browse websites, so where’s the risk? Unfortunately, the most common configuration for Wi-Fi routers involves making the DNS settings of the devices connected to it the same as its own, thus forcing all devices in the network to use the same rogue DNS. So, after gaining access to a router’s DNS settings one can control almost all the traffic in the network served by this router.

The cyber criminals were not cautious enough and left their internal infection statistics in the open part of the C&C website.

Switcher - Android Malware Seize Routers's DNS SettingsConclusion

The Trojan.AndroidOS.Switcher does not attack users directly. Instead, it targets the entire network, exposing all its users to a wide range of attacks – from phishing to secondary infection.

The main danger of such tampering with routers’ setting is that the new settings will survive even a reboot of the router, and it is very difficult to find out that the DNS has been hijacked.

Even if the rogue DNS servers are disabled for some time, the secondary DNS which was set to will be used, so users and/or IT will not be alerted.

We recommend that all users check their DNS settings and search for the following rogue DNS servers:


If you have one of these servers in your DNS settings, contact your ISP support or alert the owner of the Wi-Fi network.


Latest articles

mSpy Data Breach: Millions of Customers’ Data Exposed

mSpy, a widely used phone spyware application, has suffered a significant data breach, exposing...

Advance Auto Parts Cyber Attack: Over 2 Million Users Data Exposed

RALEIGH, NC—Advance Stores Company, Incorporated, a prominent commercial entity in the automotive industry, has...

Hackers Using ClickFix Social Engineering Tactics to Deploy Malware

Cybersecurity researchers at McAfee Labs have uncovered a sophisticated new method of malware delivery,...

Coyote Banking Trojan Attacking Windows Users To Steal Login Details

Hackers use Banking Trojans to steal sensitive financial information. These Trojans can also intercept...

Hackers Created 700+ Fake Domains to Sell Olympic Games Tickets

As the world eagerly anticipates the Olympic Games Paris 2024, a cybersecurity threat has...

Japanese Space Agency Spotted zero-day via Microsoft 365 Services

The Japan Aerospace Exploration Agency (JAXA) has revealed details of a cybersecurity incident that...

Top 10 Active Directory Management Tools – 2024

Active Directory Management Tools are essential for IT administrators to manage and secure Active...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles