Android devices compromised by BADBOX, which include phones, tablets, media players, and digital picture frames, could be leveraged not only for residential proxy service purposes that enable stealthy internet traffic routing but also to establish Gmail and WhatsApp accounts.
Aside from targeting the widely used PHP frameworks ThinkPHP, Laravel, Dedecms, and Yii in code injection attacks, Glutton has also been leveraged to exfiltrate data from the Chinese server management tool Baota, an analysis from QAX's XLab research team revealed.
Attacks with Pumakit commence with the deployment of the cron dropper, which executes the '/memfd:tgt' and '/memfd:wpn' payloads, with the former eventually launching the 'puma.ko' LKM rootkit module that loads only after ensuring secure boot status and performing kernel symbol scanning.
Malicious battery charge tracking and photo gallery apps, as well as a phony Samsung Knox app and trojanized Telegram app, have been leveraged to distribute the similar BoneSpy and PlainGnome spyware, which facilitate compromise of device location, call logs, contact lists, SMS messages, and other sensitive information.
Identified within a Gasboy fuel control system's payment terminal believed to have been targeted by the Iranian state-backed operation CyberAv3ngers, IOCONTROL features a modular configuration and sophisticated script enabling the persistent compromise of a wide range of devices from D-Link, Hikvision, Orpak, Unitronics, Teltonika, Red Lion, Baicells, and Phoenix Contact.
