tag: Banking-Trojan · 7 items
- Engineer — Learn: Novel technique of substituting legitimate banking apps with trojanized patched variants that bypass internal integrity checks is relevant to mobile app security design; no cloud/infra exposure and no KEV or PoC to force immediate action.
- SOC/IR — Learn: The app-replacement TTP is a meaningful escalation in mobile banking fraud, but no IOCs, ATT&CK mappings, or enterprise-estate detection surface were published; file away for context if mobile MDM telemetry is in scope.
- Leader — Skip
- Engineer — Learn: Hirudo’s technique of swapping patched banking APKs to bypass integrity checks is a novel supply-chain-adjacent pattern worth understanding when evaluating mobile app security controls and app attestation designs.
- SOC/IR — Plan: Build or tune detections for unauthorized APK replacement behavior on enrolled Android devices; review MDM/EMM telemetry for sideloaded or tampered banking apps in the managed estate.
- Leader — Learn: Awareness item for mobile banking risk posture; no immediate vendor exposure or regulatory trigger, but useful context if the organization offers a mobile banking app or mandates banking apps on corporate devices.
- Engineer — Skip
- SOC/IR — Learn: RatHat is an Android banking trojan MaaS with ~100 console deployments since April 2026; no IOCs or ATT&CK mappings are provided, but the AI-assisted victim prioritization technique is worth tracking as a detection research topic for mobile threat programs.
- Leader — Learn: The AI-augmented victim triage capability in this MaaS model signals an escalating threat to retail banking and mobile-first enterprises; useful context for next board or risk-committee discussion on AI-enabled fraud trends.
- Engineer — Skip
- SOC/IR — Learn: New Android MaaS platform using TVTap IPTV impersonation as a lure; worth tracking if your org manages mobile devices or BYOD — monitor for the campaign pattern if IOCs emerge.
- Leader — Skip
- Engineer — Learn: Relevant if your organization develops or distributes Android banking apps; the work-profile sandboxing abuse is a novel evasion technique worth factoring into mobile app integrity checks and attestation logic.
- SOC/IR — Learn: No IOCs or ATT&CK mappings are surfaced in this item, but the work-profile evasion mechanism is useful context for analysts triaging mobile endpoint alerts or evaluating MDM telemetry gaps.
- Leader — Skip
- Engineer — Skip
- SOC/IR — Learn: StreamRat demonstrates a malvertising delivery chain for Android banking trojans capable of near-complete device takeover; worth noting the ad-platform distribution vector for mobile threat modeling, though no IOCs or ATT&CK mappings are available to act on today.
- Leader — Skip
- Engineer — Skip
- SOC/IR — Learn: SANS ISC diary on the Astaroth/Guildma infection chain; useful for understanding email-lure TTPs, but the summary is too thin to extract IOCs — read the full diary if this actor targets your sector.
- Leader — Skip