Android malware vendor teams with marketer to promote new malware

Rogue malware can take over devices and exfiltrate data, warns researchers

Red skull and crossbones atop binary code

Security researchers have uncovered a scheme by a malware author to team up with a developer and marketer to promote a new type of Android malware called Rogue. 

According to a blog post by Check Point Research, Rogue can perform device takeover and data exfiltration,  and it’s for sale on the dark net. Triangulum, a dark net vendor, teamed up with HeXaGoN Dev to introduce the new malware.

Researchers said the first sign of Triangulum came in 2017, when it launched a mobile RAT capable of data exfiltration from C&C servers and deleting local data and, in some cases, entire operating systems. Four months later, Triangulum offered its first Android malware for sale.

Triangulum then disappeared for nearly 18 months and showed no signs of activity on the dark net. It then resurfaced on April 6, 2019 with a new product for sale. Researchers said that from this point on, Triangulum has been very active, advertising a number of products over the next six months.

Researchers speculate that during Triangulum’s hiatus from the dark net, it collaborated with another threat actor, HexaGoN Dev, to create a high-functioning production line for developing and distributing Android malware.

Rogue is part of the MRAT family (Mobile Remote Access Trojan), which gains control of the host device and exfiltrates any kind of data, modifies files on an Android device, and downloads additional malicious payloads. 

When Rogue successfully gains all the required permissions on the targeted device, it hides its icon from the device’s user to ensure it won’t be easy to get rid of it. If the user doesn’t grant all the required permissions, it’ll repeatedly ask.

HexaGoN Dev, which specializes in developing Android OS malware products, particularly RATs, partnered with Triangulum to help it sell its malware, which it’s struggled to do on its own. HexaGoN Dev helped Triangulum create different brandings for exactly the same product

“In the past, Triangulum had purchased several projects created by HeXaGoN Dev. The combination of HeXaGon Dev’s programming skills and Triangulum’s social marketing skills clearly posed a legitimate threat,” said researchers.

Yaniv Balmas, head of cyber research at Check Point, said research showed how difficult it is to track, classify, and protect against new malware in an effective way, because it’s easy for malware authors to create fake products, which may confuse security vendors.

“While we have ways of detecting such things in the real-world, the underground market is still like the wild west, which makes it very hard to quickly establish what is a real and dangerous threat and what isn’t,” he said.

Featured Resources

Choosing a collaboration platform

Eight questions every IT leader should ask

Download now

Performance benchmark: PostgreSQL/ MongoDB

Helping developers choose a database

Download now

Customer service vs. customer experience

Three-step guide to modern customer experience

Download now

Taking a proactive approach to cyber security

A complete guide to penetration testing

Download now

Recommended

HackBoss malware is using Telegram to steal cryptocurrency from other hackers
cryptocurrencies

HackBoss malware is using Telegram to steal cryptocurrency from other hackers

16 Apr 2021
How to unroot Android
Google Android

How to unroot Android

26 Mar 2021
Botnet targets vulnerable Microsoft Exchange servers
botnets

Botnet targets vulnerable Microsoft Exchange servers

23 Apr 2021

Most Popular

REvil threatens to release Apple’s hardware schematics
ransomware

REvil threatens to release Apple’s hardware schematics

21 Apr 2021
How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

8 Apr 2021
Samsung Galaxy S21 Ultra review: Ultra in every sense of the word
Mobile Phones

Samsung Galaxy S21 Ultra review: Ultra in every sense of the word

22 Apr 2021