Friday, March 29, 2024

Russian Police Busted the TipTop Hacker Group that Hacked More than 800,000 Smartphones Using Malware

TipTop hacker group know for attacking customers of Russian banks, detained by Russian authorities. The group hacked more than 800,000 smartphones.

The group was named as TipTop because their main goal is to premium clients of large Russian banks.

TipTop hacker group found to be active since 2015, and they approximately steal $1500 to $10500 daily.

How the Group Distributed Android Malware

The hacker group distributes the malware by impersonating it as a popular application for Android devices.

They disguised the malware under the mobile applications of Top-10 banks, Viber, Google Play store app and Adobe graphics app.

To infect more victim’s they placed links in legitimate source and run ads in search engine based on the keyword “mobile bank”.

Android Trojan used

It appears the group renting Android Trojan’s and tools from underground forums to infect customers of various Russian banks.

Group-IB said that the group used Hqwar banking Android Trojan in 2015, Honli Trojan in 2016, alongside they also armed with CatsElite (MarsElite) trojan.

Starting from 2017 they again returned to Hqwar mobile banker and the group parallelly used Lokibot as well as the updated version of old Trojan Marcher (Rahunok).

Trojans Capabilities

The trojan performs various functions, but the main goal of the TipTop hacker group is to steal the payment card data. Below are the Trojan Functionalities

  • Read SMS
  • Record telephone conversations
  • Send USSD requests
  • Steal bank card data using phishing pages

The group’s C&C servers found hosted in Germany, the USA, and Ukraine.

Russsian Police Search Operation

The search operation was conducted by department “K” of the Ministry of Internal Affairs in the Chuvash Republic with the assistance of Group-IB experts.

In the search operation, police found that previously convicted hacker, who involved in transferring money from customer accounts to other criminals in the group.

Search Operation Conducted by Police

“He was detained, as a result of a search conducted by police at the suspect’s place of residence, computer equipment, hard drives, flash drives, telephones, and SIM cards were found and seized.”

The 31-year-old resident of the city of Krasnoyarsk was convicted for “Creating, Using and Distributing Malicious Computer Programs” and the defendant was sentenced to 2 years probation.

“After the liquidation of the Cron group at the end of 2016, the group, which received the working name TipTop, which included a detained hacker, was one of the largest and most dangerous in Russia. Using Android Trojans, cybercriminals were able to infect more than 800,000 smartphones,” said Sergey Lupanin Head of Investigation Group-IB.

Website

Latest articles

Beware Of Weaponized Air Force invitation PDF Targeting Indian Defense And Energy Sectors

EclecticIQ cybersecurity researchers have uncovered a cyberespionage operation dubbed "Operation FlightNight" targeting Indian government...

WarzoneRAT Returns Post FBI Seizure: Utilizing LNK & HTA File

The notorious WarzoneRAT malware has made a comeback, despite the FBI's recent efforts to...

Google Revealed Kernel Address Sanitizer To Harden Android Firmware And Beyond

Android devices are popular among hackers due to the platform’s extensive acceptance and open-source...

Compromised SaaS Supply Chain Apps: 97% of Organizations at Risk of Cyber Attacks

Businesses increasingly rely on Software as a Service (SaaS) applications to drive efficiency, innovation,...

IT and security Leaders Feel Ill-Equipped to Handle Emerging Threats: New Survey

A comprehensive survey conducted by Keeper Security, in partnership with TrendCandy Research, has shed...

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles