Share:

At least 17 affiliate groups have used the “DroidBot” Android banking Trojan against 77 financial services companies across Europe, with more to come, researchers warn.

NEWS BRIEF

A fierce Android remote access Trojan (RAT), dubbed “DroidBot,” is using spyware features like keylogging and monitoring, as well as inbound and outbound data transmission, to steal data from banks, cryptocurrency exchanges, and other national organizations. But the real concern cybersecurity analysts have about the DroidBot banking Trojan is its apparent expansion into a full-on malware-as-a-service operation.

Researchers behind the discovery warned the DroidBot RAT has been active since mid-2024 and is already in heavy rotation among at least 17 affiliate groups, and has been used in 77 cyberattacks on organizations in France, Italy, Portugal, and Spain, according to a report from Cleafy. Further, evidence indicates the DroidBot Android banking Trojan is being continuously updated and is possibly on the precipice of spilling over into Latin America.

Analysis showed the developers are native Turkish speakers but have started to expand into Spanish-speaking countries, which researchers said was a sign of the operation’s intent to expand into Central and South America.

“Inconsistencies observed across multiple samples indicate that this malware is still under active development,” the report said. “These inconsistencies include placeholder functions, such as root checks, different levels of obfuscation, and multi-stage unpacking. Such variations suggest ongoing efforts to enhance the malware’s effectiveness and tailor it to specific environments.”

Android Banking Trojan-as-a-Service Emerges

In order to drop DroidBot, adversaries hide the malware in malicious banking applications and other ubiquitous applications, the researchers said, which is hardly new.

The RAT’s novelty, according to the researchers, is the use of surveillance tools including SMS message interception, keylogging, and periodically capturing screen shots of the victim device. The malware also leverages accessibility services to allow threat actors to remotely execute commands and operate the victim’s device.

“Moreover, it leverages dual-channel communication, transmitting outbound data through MQTT and receiving inbound commands via HTTPS, providing enhanced operation flexibility and resilience,” the report explained. “Recent examples of Android banking Trojans adopting this protocol include Copybara and BRATA/AmexTroll.”

Technical specs aside, Cleafy researchers raised the alarm that the rise of what appears to be a new banking RAT-as-a-service business model is a significant shift in the threat landscape.

“[W]hile the technical difficulties are not so high, the real point of concern lies in this new model of distribution and affiliation, which would elevate the monitoring of the attack surface to a whole new level,” the report said. “This could be a critical point, as changing the scale of such an important data set could significantly increase the cognitive load.”

Becky Bracken

Leave a Comment

Your email address will not be published. Required fields are marked *

loader-image
London, GB
1:11 pm, Jan 23, 2025
weather icon 8°C
L: 7° | H: 9°
light rain
Humidity: 88 %
Pressure: 999 mb
Wind: 12 mph SW
Wind Gust: 21 mph
UV Index: 0
Precipitation: 0.15 mm
Clouds: 75%
Rain Chance: 0%
Visibility: 10 km
Sunrise: 7:51 am
Sunset: 4:33 pm
DailyHourly
Daily ForecastHourly Forecast
Today 9:00 pm
weather icon
7° | 9°°C 1 mm 100% 16 mph 84 % 1003 mb 0 mm/h
Tomorrow 9:00 pm
weather icon
6° | 11°°C 1 mm 100% 24 mph 92 % 1002 mb 0 mm/h
Sat Jan 25 9:00 pm
weather icon
3° | 7°°C 0 mm 0% 10 mph 85 % 1010 mb 0 mm/h
Sun Jan 26 9:00 pm
weather icon
3° | 8°°C 1 mm 100% 18 mph 92 % 1009 mb 0 mm/h
Mon Jan 27 9:00 pm
weather icon
6° | 10°°C 1 mm 100% 26 mph 90 % 992 mb 0 mm/h
Today 3:00 pm
weather icon
8° | 8°°C 1 mm 100% 16 mph 84 % 1000 mb 0 mm/h
Today 6:00 pm
weather icon
6° | 7°°C 0.8 mm 80% 15 mph 80 % 1002 mb 0 mm/h
Today 9:00 pm
weather icon
5° | 5°°C 0 mm 0% 11 mph 83 % 1003 mb 0 mm/h
Tomorrow 12:00 am
weather icon
6° | 6°°C 0 mm 0% 10 mph 78 % 1002 mb 0 mm/h
Tomorrow 3:00 am
weather icon
9° | 9°°C 0.58 mm 58% 20 mph 92 % 996 mb 0 mm/h
Tomorrow 6:00 am
weather icon
9° | 9°°C 1 mm 100% 24 mph 88 % 992 mb 0 mm/h
Tomorrow 9:00 am
weather icon
11° | 11°°C 1 mm 100% 20 mph 91 % 992 mb 0 mm/h
Tomorrow 12:00 pm
weather icon
9° | 9°°C 1 mm 100% 16 mph 62 % 995 mb 0 mm/h
Name Price24H (%)
Bitcoin(BTC)
€97,660.94
-3.12%
Ethereum(ETH)
€3,081.72
-2.93%
XRP(XRP)
€2.94
-4.90%
Tether(USDT)
€0.96
-0.04%
Solana(SOL)
€233.88
-5.52%
USDC(USDC)
€0.96
-0.01%
Dogecoin(DOGE)
€0.333420
-4.69%
Shiba Inu(SHIB)
€0.000019
-3.50%
Pepe(PEPE)
€0.000014
-6.86%
Peanut the Squirrel(PNUT)
€0.335000
-4.94%
Scroll to Top