Thursday, April 18, 2024

Russian Police Busted the TipTop Hacker Group that Hacked More than 800,000 Smartphones Using Malware

TipTop hacker group know for attacking customers of Russian banks, detained by Russian authorities. The group hacked more than 800,000 smartphones.

The group was named as TipTop because their main goal is to premium clients of large Russian banks.

TipTop hacker group found to be active since 2015, and they approximately steal $1500 to $10500 daily.

How the Group Distributed Android Malware

The hacker group distributes the malware by impersonating it as a popular application for Android devices.

They disguised the malware under the mobile applications of Top-10 banks, Viber, Google Play store app and Adobe graphics app.

To infect more victim’s they placed links in legitimate source and run ads in search engine based on the keyword “mobile bank”.

Android Trojan used

It appears the group renting Android Trojan’s and tools from underground forums to infect customers of various Russian banks.

Group-IB said that the group used Hqwar banking Android Trojan in 2015, Honli Trojan in 2016, alongside they also armed with CatsElite (MarsElite) trojan.

Starting from 2017 they again returned to Hqwar mobile banker and the group parallelly used Lokibot as well as the updated version of old Trojan Marcher (Rahunok).

Trojans Capabilities

The trojan performs various functions, but the main goal of the TipTop hacker group is to steal the payment card data. Below are the Trojan Functionalities

  • Read SMS
  • Record telephone conversations
  • Send USSD requests
  • Steal bank card data using phishing pages

The group’s C&C servers found hosted in Germany, the USA, and Ukraine.

Russsian Police Search Operation

The search operation was conducted by department “K” of the Ministry of Internal Affairs in the Chuvash Republic with the assistance of Group-IB experts.

In the search operation, police found that previously convicted hacker, who involved in transferring money from customer accounts to other criminals in the group.

Search Operation Conducted by Police

“He was detained, as a result of a search conducted by police at the suspect’s place of residence, computer equipment, hard drives, flash drives, telephones, and SIM cards were found and seized.”

The 31-year-old resident of the city of Krasnoyarsk was convicted for “Creating, Using and Distributing Malicious Computer Programs” and the defendant was sentenced to 2 years probation.

“After the liquidation of the Cron group at the end of 2016, the group, which received the working name TipTop, which included a detained hacker, was one of the largest and most dangerous in Russia. Using Android Trojans, cybercriminals were able to infect more than 800,000 smartphones,” said Sergey Lupanin Head of Investigation Group-IB.


Latest articles

Xiid SealedTunnel: Unfazed by Yet Another Critical Firewall Vulnerability (CVE-2024-3400)

In the wake of the recent disclosure of a critical vulnerability (CVE-2024-3400) affecting a...

Cerber Linux Ransomware Exploits Atlassian Servers to Take Full Control

Security researchers at Cado Security Labs have uncovered a new variant of the Cerber...

FGVulDet – New Vulnerability Detector to Analyze Source Code

Detecting source code vulnerabilities aims to protect software systems from attacks by identifying inherent...

North Korean Hackers Abuse DMARC To Legitimize Their Emails

DMARC is targeted by hackers as this serves to act as a preventative measure...

L00KUPRU Ransomware Attackers discovered in the wild

A new variant of the Xorist ransomware, dubbed L00KUPRU, has been discovered in the...

Oracle Releases Biggest Security Update in 2024 – 372 Vulnerabilities Are Fixed – Update Now!

Oracle has released its April 2024 Critical Patch Update (CPU), addressing 372 security vulnerabilities...

Outlook Login Panel Themed Phishing Attack Evaded All Antivirus Detections

Cybersecurity researchers have uncovered a new phishing attack that has bypassed all antivirus detections.The...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.


Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles