1 million Android devices by a third party with a secret rear door for the scammers

Researchers from many companies say the campaign seems to come from a loose environmental system for fraud groups instead of one representative. Each group has its own versions of Badbox 2.0 background units, harmful programs and distribution of the program in several ways. In some cases, malicious applications are pre -installed on the devices that are penetrated, but in many examples followed by researchers, attackers deceive users in installing unknown applications.

The researchers highlight the technology in which the fraudsters create a Hamid app – Say, game – in the Google Play Store to show that it has been examined, but then deceive users to download almost identical versions of the application that has not been hosted in official and harmful application stores. The researchers say that the “evil twin” applications appeared at least 24 times, allowing the attackers to operate the advertising fraud in the Google Play versions of their applications, and the distribution of harmful programs in their fatty applications. Man also found that the fraudsters distributed more than 200 versions that were at risk from the famous prevailing applications as another way to spread their background.

“We have seen four different types of fraud units – among them from advertising fraud units, one click, then one residential agent – but it is extendable,” says Lindsay Kai, Vice President of the Human, Deputy of the threat network. “So you can imagine how, if the time persists and you can develop more stereotypes, and perhaps formulate more relationships, there is an opportunity to get more relationships.”

Researchers from Trend Micro collaborated with Human on The Badbox 2.0, with a special focus on actors behind this activity.

“The size of the process is huge,” says Fyodor Yarochkin, a senior threat in Trend Micro. He added that although there are “up to one million devices online easily” for any of the groups, “this is only a number of devices currently connected to its platform. If you calculate all the devices that are likely to have their load, it is possible that it exceeds a few million.”

Yarochkin adds that many groups participating in the campaigns seem to have some contact with advertising and marketing companies in the Chinese market. More than a decade ago, Yarochkin explains, was there numerous legal Cases In China The companies installed “silent” accessories on the devices and used them for a variety of fraudulent activity.

“The companies that survived mainly at the age of 2015 were the companies that adapted,” says Yarukkin. He notes that his investigations have now identified “multiple business entities” in China, which seems to be linked to some groups participating in Badbox 2. The links include economic and technical links. “We have identified their addresses, we have seen some pictures of their offices, and they have accounts for some employees on LinkedIn.”

Human, the small trend, and Google also with the Internet Security Group Shade To deduct the largest possible amount of Badbox 2.0 infrastructure sink Robots mainly send traffic and instructions requests in a vacuum. But the researchers warn of this after the fraudsters embraced followers Revealing the original BadBox schemeBadbox 2.0 is unlikely to present the activity permanently.

“As a consumer, you should keep in mind that if the device is very cheap to be correct, you should be prepared for the presence of some additional hidden surprises in the device,” says Yarochkin of Trend Micro. “There is no free cheese unless the cheese is in the mice trap.”