Connect with us

Hi, what are you looking for?

Tech

Medusa Trojan Makes a Comeback: New Malware Variants Target Global Users

Medusa Trojan Makes a Comeback New Malware Variants Target Global Users
Medusa Trojan Makes a Comeback New Malware Variants Target Global Users

The Medusa banking trojan, also known as TangleBot, has resurfaced after a year of low activity and is now targeting countries including France, Italy, the United States, Canada, Spain, the United Kingdom, and Turkey. This resurgence, observed since May, involves more compact variants of the malware, which require fewer permissions and incorporate new features to facilitate transactions directly from compromised devices.

Medusa, a malware-as-a-service (MaaS) operation discovered in 2020, provides functionalities such as keylogging, screen control, and SMS manipulation. Despite sharing a name, this operation is distinct from the ransomware gang and the Mirai-based botnet associated with DDoS attacks.

The recent Medusa campaigns were detected by Cleafy, an online fraud management company, which noted that the new malware variants are lighter and include capabilities like full-screen overlaying and screenshot capturing. These campaigns, first evidenced in July 2023, primarily use SMS phishing (smishing) to distribute the malware through dropper applications.

Medusa Trojan Makes a Comeback New Malware Variants Target Global Users

Medusa Trojan Makes a Comeback New Malware Variants Target Global Users

Cleafy identified 24 campaigns linked to five separate botnets: UNKN, AFETZEDE, ANAKONDA, PEMBE, and TONY. The UNKN botnet, in particular, targets European countries such as France, Italy, Spain, and the UK, using dropper apps like a fake Chrome browser, a 5G connectivity app, and a fake streaming app called 4K Sports.

The timing of the use of the 4K Sports streaming app is significant, as it coincides with the UEFA EURO 2024 championship, making it a timely bait for unsuspecting users.

All the campaigns and botnets are managed by Medusa’s central infrastructure, which dynamically updates command and control (C2) server URLs through public social media profiles. This centralized approach helps efficiently orchestrate the malware’s operations across various campaigns and regions.

The latest variant of Medusa has a reduced footprint on compromised devices, requesting only a limited set of permissions while still requiring Android’s Accessibility Services. The malware retains its ability to access the victim’s contact list and send SMS, a critical distribution method.

Cleafy’s analysis indicates that the authors removed 17 commands from the previous version and introduced five new ones, including commands for uninstalling specific applications, requesting ‘Drawing Over’ permissions, setting a black screen overlay, taking screenshots, and updating user secrets.

The ‘setoverlay’ command, in particular, enables deceptive actions such as making the device appear locked or shut off to conceal ongoing malicious activities.

The addition of screenshot-capturing capabilities represents a significant enhancement, allowing threat actors to steal sensitive information from infected devices. The Medusa banking trojan operation is becoming more sophisticated and stealthier, potentially paving the way for larger-scale deployments and increased victim numbers.

While Cleafy has not yet found any dropper apps on Google Play, the growing number of cybercriminals involved in the MaaS operation suggests that distribution strategies will continue to evolve and become more sophisticated, posing an increasing threat to users worldwide.

Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

You May Also Like

Tech

Amazon Web Services (AWS) recently unveiled several innovations aimed at enhancing the development and deployment of generative AI applications, addressing concerns around accuracy and...

News

AU10TIX, an Israeli company that verifies IDs for clients like TikTok, X, and Uber, accidentally left important admin credentials exposed for over a year....

Cars

At vero eos et accusamus et iusto odio dignissimos ducimus qui blanditiis praesentium voluptatum deleniti atque corrupti quos.

Tech

At vero eos et accusamus et iusto odio dignissimos ducimus qui blanditiis praesentium voluptatum deleniti atque corrupti quos.