Suspicious Activity In Malwarelytics Indicates Future Cyber Attack Aiming at 775 Banks
By: Petr Dvořák
Tags: Cybersecurity, Threat Intelligence, Mobile, Press Release, Banking

Suspicious Activity In Malwarelytics Indicates Future Cyber Attack Aiming at 775 Banks

On Thursday, April 22, between 09:03:12 GMT and 09:06:25 GMT, we noticed suspicious activity in the Malwarelytics threat intelligence back-end systems. After investigating the incident, we assume that the activity could be a part of a complex mobile banking malware attack on Android. The scenario is in preparation. The cybercriminals are now attempting to tamper the cyber defense systems (probably from various vendors) that could stop or minimize the attack’s impact. Petr Dvořák Apr 26·5 min read

We want to issue an early warning to the banks that could be affected. Not all of them are currently our customers.

In the case of any questions, do not hesitate to contact us at hello@wultra.com.

Recommendation

We recommend the following next steps:

Intensify the “be careful” messaging towards your customer base.

Ask your customers to only download mobile apps from Google Play.

Remind the customers not to share the internet banking credentials in the mobile app.

Ask your customers to report any suspicious app activity — glitchy user interface, sudden changes in the app authentication, suspicious instructions, etc.

Ask your customers not to share their credentials, such as the password or the SMS OTPs, via the phone or chat applications.

Stay alert and be ready to respond quickly when the mobile malware strikes.

What Happened?

We identified several suspicious requests in our systems for mobile banking malware detection. The structure of these requests and the way these requests were made indicate that they were manually crafted. The attacker created the requests in an advanced setup, reverse-engineering banking apps first and bypassing several protections we have in place in the mobile SDK. While removing those security layers does not alone create a security problem or directly threaten the customer accounts safety, we are now 100% sure that someone is actively trying to tamper with our systems to maximize the impact of the attack and remove the obstacles.

What Was the Attacker Aiming For?

We assume that the attacker was trying to examine our malware detection systems and “train” them not to recognize problematic malware apps (pretending to be the banking apps) by faking the on-device detection results. Luckily, we do not rely only on those detections when accepting the signals from the mobile app and evaluating the risk that apps pose to mobile banking.

Where Did These Requests Originate?

We lost track of the attacker trail at the well-known VPN proxy infrastructure. We notified the provider about the original requests, and the provider promptly proceeded with the investigation on their end. Due to the nature of the attack, we believe that the attacker already broke the law. We will contact the local authorities for assistance with the investigation.

Which Banks Could Be Affected?

We identified the following package names in the requests, the list is likely an updated list that was previously used by BankBot campaigns: