Russian Police Busted the TipTop Hacker Group that Hacked More than 800,000 Smartphones Using Malware

TipTop hacker group know for attacking customers of Russian banks, detained by Russian authorities. The group hacked more than 800,000 smartphones.

The group was named as TipTop because their main goal is to premium clients of large Russian banks.

TipTop hacker group found to be active since 2015, and they approximately steal $1500 to $10500 daily.

How the Group Distributed Android Malware

The hacker group distributes the malware by impersonating it as a popular application for Android devices.

They disguised the malware under the mobile applications of Top-10 banks, Viber, Google Play store app and Adobe graphics app.

To infect more victim’s they placed links in legitimate source and run ads in search engine based on the keyword “mobile bank”.

Android Trojan used

It appears the group renting Android Trojan’s and tools from underground forums to infect customers of various Russian banks.

Group-IB said that the group used Hqwar banking Android Trojan in 2015, Honli Trojan in 2016, alongside they also armed with CatsElite (MarsElite) trojan.

Starting from 2017 they again returned to Hqwar mobile banker and the group parallelly used Lokibot as well as the updated version of old Trojan Marcher (Rahunok).

Trojans Capabilities

The trojan performs various functions, but the main goal of the TipTop hacker group is to steal the payment card data. Below are the Trojan Functionalities

• Read SMS
• Record telephone conversations
• Send USSD requests
• Steal bank card data using phishing pages

The group’s C&C servers found hosted in Germany, the USA, and Ukraine.

Russsian Police Search Operation

The search operation was conducted by department “K” of the Ministry of Internal Affairs in the Chuvash Republic with the assistance of Group-IB experts.

In the search operation, police found that previously convicted hacker, who involved in transferring money from customer accounts to other criminals in the group.

“He was detained, as a result of a search conducted by police at the suspect’s place of residence, computer equipment, hard drives, flash drives, telephones, and SIM cards were found and seized.”

The 31-year-old resident of the city of Krasnoyarsk was convicted for “Creating, Using and Distributing Malicious Computer Programs” and the defendant was sentenced to 2 years probation.

“After the liquidation of the Cron group at the end of 2016, the group, which received the working name TipTop, which included a detained hacker, was one of the largest and most dangerous in Russia. Using Android Trojans, cybercriminals were able to infect more than 800,000 smartphones,” said Sergey Lupanin Head of Investigation Group-IB.