A large-scale banking botnet has targeted approximately 800,000 Android devices belonging to Russian citizens since at least 2016, according to a new research report by a trio of cybersecurity researchers.
The botnet, which researchers call Geost, used at least 140 malicious domains and 13 command-and-control servers scattered throughout the world to target victims and expand its reach.
Over the years, the attackers behind Geost had access to “several million Euros” within Russian bank accounts, according to the researchers. It’s not clear, however, how much the group may have taken over the last three years.
The researchers found that the attackers targeted customers of at least five Russian and Eastern European banks by hijacking SMS traffic between these financial firms and their customers.
The Geost botnet was designed to target Android devices, according to the research report.
The devices were targeted with 150 APKs – programs for Android devices that allow users to download Gmail attachments to their devices. The researchers found that the APKs resembled a number of fake applications that mimicked legitimate apps found in the official Google Play store, including those for banks and social networks.
Malware Hash (SHA256)