Story image

ESET discovers new Android botnet controlled by Twitter

29 Aug 16

ESET has discovered the first-ever Twitter-controlled Android botnet. 

According to the security firm, reseaerchers have discovered an Android backdoor Trojan that is controlled by tweets.

Detected by ESET as Android/Twitoor, it’s the first malicious app using Twitter instead of a traditional command-and-control (C&C) server, the company explains.

After launch, the Trojan hides its presence on the system and checks the defined Twitter account in regular intervals for commands.

Based on received commands, it can either download malicious apps or change the C&C Twitter account to another one.

“Using Twitter to control a botnet is an innovative step for an Android platform,” says Lukáš Štefanko, the ESET malware researcher who discovered the malicious app.

According to Štefanko, communication channels based on social networks are hard to discover and impossible to block entirely, while simultaneously being extremely easy for the crooks to re-direct communications to another account.

Twitter was first used to control Windows botnets in 2009. 

“As for the Android space, this means of hiding has remained untapped until now. In the future, however, we can expect that the bad guys will try to make use of Facebook statuses or deploy LinkedIn and other social networks,” says Štefanko.

Štefanko says Android/Twitoor has been active since July, 2016. It can’t be found on any official Android app store, but probably spreads by SMS or via malicious URLs.

It impersonates a porn player app or MMS application but without the functionality, Štefanko explains. Instead, it has been downloading several versions of mobile banking malware.

However, the botnet operators can start distributing other malware at any time, including ransomware, according to Štefanko.

“Twitoor serves as another example of cyber criminals innovating their business. Internet users should keep on securing their activities with good security solutions for both computers and mobile devices,” says Štefanko.

Disruption in the supply chain: Why IT resilience is a collective responsibility
"A truly resilient organisation will invest in building strong relationships while the sun shines so they can draw on goodwill when it rains."
Businesses too slow on attack detection – CrowdStrike
The 2018 CrowdStrike Services Cyber Intrusion Casebook reveals IR strategies, lessons learned, and trends derived from more than 200 cases.
What disaster recovery will look like in 2019
“With nearly half of all businesses experiencing an unrecoverable data event in the last three years, current backup solutions are no longer fit for purpose."
Proofpoint launches feature to identify most targeted users
“One of the largest security industry misconceptions is that most cyberattacks target top executives and management.”
McAfee named Leader in Magic Quadrant an eighth time
The company has been once again named as a Leader in the Gartner Magic Quadrant for Security Information and Event Management.
Symantec and Fortinet partner for integration
The partnership will deliver essential security controls across endpoint, network, and cloud environments.
Is Supermicro innocent? 3rd party test finds no malicious hardware
One of the larger scandals within IT circles took place this year with Bloomberg firing shots at Supermicro - now Supermicro is firing back.
25% of malicious emails still make it through to recipients
Popular email security programmes may fail to detect as much as 25% of all emails with malicious or dangerous attachments, a study from Mimecast says.