Tuesday, November 5, 2024
HomeAndroidRussian Police Busted the TipTop Hacker Group that Hacked More than 800,000...

Russian Police Busted the TipTop Hacker Group that Hacked More than 800,000 Smartphones Using Malware

Published on

Malware protection

TipTop hacker group know for attacking customers of Russian banks, detained by Russian authorities. The group hacked more than 800,000 smartphones.

The group was named as TipTop because their main goal is to premium clients of large Russian banks.

TipTop hacker group found to be active since 2015, and they approximately steal $1500 to $10500 daily.

- Advertisement - SIEM as a Service

How the Group Distributed Android Malware

The hacker group distributes the malware by impersonating it as a popular application for Android devices.

They disguised the malware under the mobile applications of Top-10 banks, Viber, Google Play store app and Adobe graphics app.

To infect more victim’s they placed links in legitimate source and run ads in search engine based on the keyword “mobile bank”.

Android Trojan used

It appears the group renting Android Trojan’s and tools from underground forums to infect customers of various Russian banks.

Group-IB said that the group used Hqwar banking Android Trojan in 2015, Honli Trojan in 2016, alongside they also armed with CatsElite (MarsElite) trojan.

Starting from 2017 they again returned to Hqwar mobile banker and the group parallelly used Lokibot as well as the updated version of old Trojan Marcher (Rahunok).

Trojans Capabilities

The trojan performs various functions, but the main goal of the TipTop hacker group is to steal the payment card data. Below are the Trojan Functionalities

  • Read SMS
  • Record telephone conversations
  • Send USSD requests
  • Steal bank card data using phishing pages

The group’s C&C servers found hosted in Germany, the USA, and Ukraine.

Russsian Police Search Operation

The search operation was conducted by department “K” of the Ministry of Internal Affairs in the Chuvash Republic with the assistance of Group-IB experts.

In the search operation, police found that previously convicted hacker, who involved in transferring money from customer accounts to other criminals in the group.

Search Operation Conducted by Police

“He was detained, as a result of a search conducted by police at the suspect’s place of residence, computer equipment, hard drives, flash drives, telephones, and SIM cards were found and seized.”

The 31-year-old resident of the city of Krasnoyarsk was convicted for “Creating, Using and Distributing Malicious Computer Programs” and the defendant was sentenced to 2 years probation.

“After the liquidation of the Cron group at the end of 2016, the group, which received the working name TipTop, which included a detained hacker, was one of the largest and most dangerous in Russia. Using Android Trojans, cybercriminals were able to infect more than 800,000 smartphones,” said Sergey Lupanin Head of Investigation Group-IB.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Evasive Panda Attacking Cloud Services To Steal Data Using New Toolkit

The Evasive Panda group deployed a new C# framework named CloudScout to target a...

Massive Midnight Blizzard Phishing Attack Using Weaponized RDP Files

Researchers warn of ongoing spear-phishing attacks by Russian threat actor Midnight Blizzard targeting individuals...

Sophisticated Phishing Attack Targeting Ukraine Military Sectors

The Ukrainian Cyber Emergency Response Team discovered a targeted phishing campaign launched by UAC-0215...

Chinese Hackers Attacking Microsoft Customers With Sophisticated Password Spray Attacks

Researchers have identified a network of compromised devices, CovertNetwork-1658, used by Chinese threat actors...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Evasive Panda Attacking Cloud Services To Steal Data Using New Toolkit

The Evasive Panda group deployed a new C# framework named CloudScout to target a...

Massive Midnight Blizzard Phishing Attack Using Weaponized RDP Files

Researchers warn of ongoing spear-phishing attacks by Russian threat actor Midnight Blizzard targeting individuals...

Sophisticated Phishing Attack Targeting Ukraine Military Sectors

The Ukrainian Cyber Emergency Response Team discovered a targeted phishing campaign launched by UAC-0215...