Story image

ESET discovers new Android botnet controlled by Twitter

29 Aug 2016

ESET has discovered the first-ever Twitter-controlled Android botnet. 

According to the security firm, reseaerchers have discovered an Android backdoor Trojan that is controlled by tweets.

Detected by ESET as Android/Twitoor, it’s the first malicious app using Twitter instead of a traditional command-and-control (C&C) server, the company explains.

After launch, the Trojan hides its presence on the system and checks the defined Twitter account in regular intervals for commands.

Based on received commands, it can either download malicious apps or change the C&C Twitter account to another one.

“Using Twitter to control a botnet is an innovative step for an Android platform,” says Lukáš Štefanko, the ESET malware researcher who discovered the malicious app.

According to Štefanko, communication channels based on social networks are hard to discover and impossible to block entirely, while simultaneously being extremely easy for the crooks to re-direct communications to another account.

Twitter was first used to control Windows botnets in 2009. 

“As for the Android space, this means of hiding has remained untapped until now. In the future, however, we can expect that the bad guys will try to make use of Facebook statuses or deploy LinkedIn and other social networks,” says Štefanko.

Štefanko says Android/Twitoor has been active since July, 2016. It can’t be found on any official Android app store, but probably spreads by SMS or via malicious URLs.

It impersonates a porn player app or MMS application but without the functionality, Štefanko explains. Instead, it has been downloading several versions of mobile banking malware.

However, the botnet operators can start distributing other malware at any time, including ransomware, according to Štefanko.

“Twitoor serves as another example of cyber criminals innovating their business. Internet users should keep on securing their activities with good security solutions for both computers and mobile devices,” says Štefanko.

ESET researchers break down latest arsenal of the infamous Sednit group
At the end of August 2018, the Sednit group launched a spear-phishing email campaign, in which it distributed shortened URLs that delivered first-stage Zebrocy components.
Container survey shows adoption accelerating while security concerns remain top of mind
The report features insights from over 500 IT professionals.
Google 'will do better' after G Suite passwords exposed since 2005
Fourteen years is a long time for sensitive information like usernames and passwords to be sitting ducks, unencrypted and at risk of theft and corruption.
Fake apps on Google Play scamming users out of cryptocurrency
Fake cryptocurrency apps on Google Play have been discovered to be phishing and scamming users out of cryptocurrency, according to a new report from ESET.
Hackbusters! Reviewing 90 days of cybersecurity incident response cases
While there are occasionally very advanced new threats, these are massively outnumbered by common-or-garden email fraud, ransomware attacks and well-worn old exploits.
SEGA turns to Palo Alto Networks for cybersecurity protection
When one of the world’s largest video game pioneers wanted to strengthen its IT defences against cyber threats, it started with firewalls and real-time threat intelligence from Palo Alto Networks.
Forrester names Trend Micro Leader in email security
TrendMicro earned the highest score for technology leadership, deployment options and cloud integration.
LogRhythm releases cloud-based SIEM solution
LogRhythm Cloud provides the same feature set and user experience as its on-prem experience.