Thursday, March 28, 2024

Russian Police Busted the TipTop Hacker Group that Hacked More than 800,000 Smartphones Using Malware

TipTop hacker group know for attacking customers of Russian banks, detained by Russian authorities. The group hacked more than 800,000 smartphones.

The group was named as TipTop because their main goal is to premium clients of large Russian banks.

TipTop hacker group found to be active since 2015, and they approximately steal $1500 to $10500 daily.

How the Group Distributed Android Malware

The hacker group distributes the malware by impersonating it as a popular application for Android devices.

They disguised the malware under the mobile applications of Top-10 banks, Viber, Google Play store app and Adobe graphics app.

To infect more victim’s they placed links in legitimate source and run ads in search engine based on the keyword “mobile bank”.

Android Trojan used

It appears the group renting Android Trojan’s and tools from underground forums to infect customers of various Russian banks.

Group-IB said that the group used Hqwar banking Android Trojan in 2015, Honli Trojan in 2016, alongside they also armed with CatsElite (MarsElite) trojan.

Starting from 2017 they again returned to Hqwar mobile banker and the group parallelly used Lokibot as well as the updated version of old Trojan Marcher (Rahunok).

Trojans Capabilities

The trojan performs various functions, but the main goal of the TipTop hacker group is to steal the payment card data. Below are the Trojan Functionalities

  • Read SMS
  • Record telephone conversations
  • Send USSD requests
  • Steal bank card data using phishing pages

The group’s C&C servers found hosted in Germany, the USA, and Ukraine.

Russsian Police Search Operation

The search operation was conducted by department “K” of the Ministry of Internal Affairs in the Chuvash Republic with the assistance of Group-IB experts.

In the search operation, police found that previously convicted hacker, who involved in transferring money from customer accounts to other criminals in the group.

Search Operation Conducted by Police

“He was detained, as a result of a search conducted by police at the suspect’s place of residence, computer equipment, hard drives, flash drives, telephones, and SIM cards were found and seized.”

The 31-year-old resident of the city of Krasnoyarsk was convicted for “Creating, Using and Distributing Malicious Computer Programs” and the defendant was sentenced to 2 years probation.

“After the liquidation of the Cron group at the end of 2016, the group, which received the working name TipTop, which included a detained hacker, was one of the largest and most dangerous in Russia. Using Android Trojans, cybercriminals were able to infect more than 800,000 smartphones,” said Sergey Lupanin Head of Investigation Group-IB.

Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles