Eskenzi PR ad banner Eskenzi PR ad banner
  • About Us
Friday, 31 March, 2023
IT Security Guru
Eskenzi PR banner
  • Home
  • Features
  • Insight
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us
No Result
View All Result
  • Home
  • Features
  • Insight
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us
No Result
View All Result
IT Security Guru
No Result
View All Result

Mobile Advertising Trojans Exploiting Super-User Rights Became the Top Mobile Malware Threat in 2016

by The Gurus
March 1, 2017
in Editor's News
mobile
Share on FacebookShare on Twitter

2016 saw a near-threefold rise in mobile malware detections compared to 2015 – with a total of 8.5 million malicious installations identified. This means that, in the space of just one year, a volume equivalent to 50 per cent of all the malware detected in the previous 11 years (15.77 million in 2004 – 2015) was released. Leading the way were mobile advertising Trojans which now make up 16 of the top 20 malicious programs, up from 12 in 2015. These are the findings of Kaspersky Lab’s annual Mobile Virusology report, which also highlights the evolution of mobile banking Trojans. Specialist officers from INTERPOL’s Global Complex for Innovation have contributed an analysis of mobile malware on the Dark Web to the report.
In 2016, Kaspersky Lab mobile security products reported:

  • Nearly 40 million attack attempts by mobile malware, with over 4 million users of Android-based devices protected (vs 2.6 million in 2015)
  • Over 260,000 detections of installation packages for mobile ransomware Trojans (an increase of almost 8.5 times, year-on-year)
  • More than 153,000 unique users targeted by mobile ransomware (an increase of 1.6 times compared with 2015)
  • Over 128,000 mobile banking Trojans detected (nearly 1.6 times more than in 2015)

Advertising Trojan: is your device already rooted?

  • The most widespread type of Trojan in 2016 was the advertising variety, accounting for 16 of the top 20 malware programs

These Trojans are capable of seizing rooting rights, allowing the malware to not only aggressively display ads on the infected device, often making it impossible to use, but also to secretly install other applications. These Trojans can also buy apps on Google Play.
In many cases, the Trojans were able to exploit previously patched vulnerabilities because the user had not installed the latest update.
Further, this malware simultaneously installs its modules in the system directory, which makes the treatment of the infected device very difficult. Some advertising Trojans are even able to infect the recovery image, making it impossible to solve the problem by restoring the device to factory settings.
Representatives of this class of malicious software have been repeatedly found in the official Google Play app store, for example, masquerading as a guide for Pokemon GO. In this case, the app was downloaded over 500,000 times, and is detected as a Trojan.AndroidOS.Ztorg.ad.
Mobile ransomware: further development

  • In 2016, 153,258 unique users from 167 countries were attacked by Trojan-Ransom programs; this is 1.6 times more than in 2015.
  •  

Modern ransomware overlays windows with demand messages, thus making it impossible to use the device. This principle was used by the most popular mobile ransomware program in 2016 – Trojan-Ransom.AndroidOS.Fusob.
This Trojan mostly attacks users in Germany, the US and the UK, but avoids users from the CIS and some neighboring countries. Once launched, it runs a check of the device language and, after achieving some results, it may stop execution. The cybercriminals behind the Trojan usually demand between $100 and $200 to unblock a device. The ransom has to be paid using codes from pre-paid iTunes cards.
Mobile banking Trojan: a skyrocketing threat

  • In 2016, over 305,000 users in 164 countries were attacked by mobile banking Trojans, compared with over 56,000 users in 137 countries the previous year.
  • Russia, Australia and Ukraine are the top 3 countries affected in terms of the percentage of users attacked by mobile banking Trojans relative to all users hit by mobile malware.

 Mobile banking Trojans continued to evolve through the year. Many of them gained tools to bypass the new Android security mechanisms and were able to continue stealing user information from the most recent versions of the OS. At the same time, the developers of mobile banking Trojans repeatedly enhanced their creations with new capabilities. For instance, the Marcher family, in addition to implementing the usual banking applications’ overlay, redirected users from financial institutions’ websites to phishing pages.
The Dark Web delusion
According to specialist officers from INTERPOL’s Global Complex for Innovation, who have also contributed to the report, the Dark Web remains an attractive medium for conducting illicit businesses and activities. Given its robust anonymity, low prices and client-oriented strategy, the Dark Web provides a means for criminal actors to communicate and engage in commercial transactions, buying and selling various products and services, including mobile malware kits. Mobile malware is offered for sale as software packages (e.g. remote access Trojans – RATs), individual solutions and sophisticated tools, like those developed by professional firms or, on a smaller scale, as part of a ‘Bot as a Service’ model. Mobile malware is also a ‘subject of interest’ on vendor shops, forums and social media.
“In 2016, the growth in the number of advertising Trojans capable of exploiting super-user rights continued. Throughout the year, it was the top threat and we see no sign of this trend changing. Cybercriminals are taking advantage of the fact that most devices do not receive OS updates (or receive them late), and are thus vulnerable to old, well-known and readily available exploits. Moreover, we see that the mobile landscape is getting a little crowded for cybercriminals, and they are beginning to interact more with the world beyond smartphones. Perhaps in 2017 we will see major attacks on IoT components launched from mobile devices,” concludes Roman Unuchek, Senior Malware Analyst at Kaspersky Lab USA.
To learn more about the mobile malware evolution in 2016, read the blog post available at Securelist.com.

FacebookTweetLinkedIn
ShareTweetShare
Previous Post

Over a million worldwide cyberattacks on online lending transactions in 2016 with the potential loss of £8 billion

Next Post

Think you know cyber security? Think again – world’s most famous hacker comes to IP EXPO Manchester

Recent News

Data Privacy Day: Securing your data with a password manager

For Cybersecurity, the Tricks Come More Than Once a Year

March 31, 2023
cybersecurity training

Only 10% of workers remember all their cyber security training

March 30, 2023
Pie Chart, Purple

New API Report Shows 400% Increase in Attackers

March 29, 2023
Cato Networks delivers first CASB for instant visibility and control of cloud application data risk

Cato Networks Recognised as Leader in Single-Vendor SASE Quadrant Analysis

March 29, 2023

The IT Security Guru offers a daily news digest of all the best breaking IT security news stories first thing in the morning! Rather than you having to trawl through all the news feeds to find out what’s cooking, you can quickly get everything you need from this site!

Our Address: 10 London Mews, London, W2 1HY

Follow Us

© 2015 - 2019 IT Security Guru - Website Managed by Calm Logic

  • About Us
No Result
View All Result
  • Home
  • Features
  • Insight
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us

© 2015 - 2019 IT Security Guru - Website Managed by Calm Logic

This site uses functional cookies and external scripts to improve your experience.

Privacy settings

Privacy Settings / PENDING

This site uses functional cookies and external scripts to improve your experience. Which cookies and scripts are used and how they impact your visit is specified on the left. You may change your settings at any time. Your choices will not impact your visit.

NOTE: These settings will only apply to the browser and device you are currently using.

GDPR Compliance

Powered by Cookie Information