Analysts Detect New Banking Malware
Leo Daniels • July 23, 2020
This is a subtitle for your new post
A new strain of banking malware dubbed BlackRock has been detected by researchers at Threat Fabric.
An investigation into its origins has revealed BlackRock to be derived from the Xerxes banking malware. Xerxes was in turn spawned out of the LokiBot Android banking Trojan, first detected around four years ago.
The source code of the Xerxes malware was made public by its author around May 2019, making it possible for any threat actor to get their hands on it. Despite the code’s availability, researchers found that the only Android banking Trojan based on Xerxes’ source code that is currently operating appears to be BlackRock.
This malevolent malware steals credentials not only from banking apps but also from other apps designed to facilitate communication, shopping and business. In total, the team found 337 Android apps were impacted, including dating, social networking and cryptocurrency apps.
By throwing their nefarious campaign net so wide, researchers believe the malware’s creators are attempting to exploit the increase in online socializing brought about by the outbreak of COVID-19.
“Technical aspects aside, one of the interesting differentiators of BlackRock is its target list; it contains an important number of social, networking, communication and dating applications,” noted researchers.
“So far, many of those applications haven’t been observed in target lists for other existing banking Trojans. It therefore seems that the actors behind BlackRock are trying to abuse the growth in online socializing that increased rapidly in the last months due to the pandemic situation.”
BlackRock was first spotted back in May 2020. When the malware is launched on a device for the first time, its icon is hidden from the app drawer, making it invisible to the end user. The malware then asks the victim for the Accessibility Service privileges, often posing as a Google update.
Once the user grants the request, BlackRock starts granting itself the additional permissions required for the bot to fully function without having to interact any further with the victim. When done, the bot is functional and ready to receive commands from the C2 server and perform the overlay attacks.
“Unfortunately, this malware is particularly sophisticated and can camouflage itself as a genuine app to do some damaging spy work in the background,” commented ESET
cybersecurity specialist Jake Moore.
“It is vital that users know what apps they are downloading, or they may risk unknowingly downloading something illicit.”
We’re 1-fix, we can help you secure your business
At 1-fix, we take a realistic approach to technology – ensuring our client’s systems are best protected.
If you have any concerns, questions or simply want to explore how to better secure your business, please do get in touch with the team for a FREE demonstration, consultation to explore how exposed your business might be and identify actions to take.
Join Our Mailing List
All sign-ups are handled inline with our privacy policy and can unsubscribe at any time.
Recent Blogs
In a world where AI is changing how we work and compete, security is more important than ever. We are gathering industry leaders and AI experts for a special roundtable event. This event will focus on a key topic: AI security.
Microsoft 365 Business Basic offers a range of cloud-based services designed to empower businesses to work smarter and more efficiently. Let's delve into what this package includes and how it can benefit your organisation.
We’re excited to announce an informative webinar featuring Elliot Wilkie from Brigantia and Craig Atkins from 1-Fix, diving deep into the world of DMARC on 8th July at 2 PM . This is an essential session for anyone looking to secure their email communications, understand DMARC compliance, and enhance their email deliverability.
Businesses are constantly seeking ways to enhance productivity, collaboration, and security, all whilst managing costs effectively. Microsoft Office 365 presents a comprehensive solution that caters to these needs. Here’s a breakdown of the seven key benefits of using Office 365 for your business.
In recent news from Microsoft, there’s significant information affecting charity organisations that rely on Microsoft 365 for their everyday operations. Microsoft has announced that it will be discontinuing the Microsoft 365 Business Premium grant, which currently provides 10 free licenses to nonprofits, with termination slated for March 8, 2026 . Therefore, charities currently benefitting from this grant must prepare for upcoming changes.
Staying efficient and connected has never been more important for businesses. With the increasing demand for remote work solutions and collaborative tools, migrating to Microsoft Office 365 is becoming an essential strategy. In this blog post, we’ll explore the many benefits of Office 365 migration, how 1-Fix can assist you in the process, and how swift and seamless this transition can be.
