There is a hidden back door for cheats on Android devices for 1 million third party

Researchers from more than one company say that the campaign came from a single actor from a single actor’s free-related ecosystem of fraud. In each group, Badbox 2.0 has its own options for Backdoor and malware modules and distribute the program in different ways. In some cases, malicious applications are pre-installed on discounted devices, but in many samples, which are monitored by researchers, aggressors are involved in the installation of soft applications without knowing users.

Researchers send a game to show a technique of cheats’ benign app that is a game that is noisy in Google’s game store, but use the same versions of users in the official app stores and download the same versions of the application. Such “Bad Twins” applications showed at least 24 times, researchers allow attackers to launch ads on Google Play versions and allow harmful programs to their application. Man revealed that the scammers redistricted and distributed a re-distributed version of more than 200 concessions, popular, basic applications.

“Four different fraud modules, two advertising scammers, fake, and then fake, and then a wide proxy network, but expanded,” said Lindsay Kaye, Vice President of Human. “So if the time passed and could develop more modules, maybe if they could have more relationship, there are opportunities for additional ones.”

Security company researchers focus on Trend Micro Badbox 2.0 investigation, especially behind the activities.

Fyodor Yarockkin, who said, “The scale of the operation is a huge,” is a trend Micro header researcher. Although it is “an online unit for an online” online “for any group,” this is a number of devices that are currently on their platform. Probably if you serve all the devices that will take their burden, it will probably exceed several million. “

Most of the groups participating in campaigns seem to have a connection to Chinese gray market advertising and marketing firms. More than a decade ago, Yarockkin explains, there was many legal situations In China In which companies, “silent” plugins were installed on the devices and used the seemingly counterfeit activity for a variety of counterfeit activities.

“Companies living since the age of 2015 are companies that are adapted. He notes that research has now determined many “businesses” in China, which appears to be related to some groups participating in Badbox 2. The relationship covers both economic and technical connections. “We have identified their addresses, we have seen some of their offices, some employees have accounts in LinkedIn,” he says.

Human, Trend Micro and Google, also collaborated with the Internet security team Shadow server As much as possible Badbox 2.0 infrastructure sinkholing Botnet is therefore sending traffic and instruction requirements to a space. However, researchers warn after scams after the pivint of benchmarks Tokens about the original Badbox schemeIt is impossible to expose Badbox 2.0 that the activity will always end.

“If the device is very cheap to have the device, you need to think that some additional surprises hiding on the device,” said Trend Micro’s Yarockkin. “There’s no free cheese without cheese mousetrapa.”