Skypher is a fast-growing Y Combinator backed start-up based in San Francisco and Paris

Skypher

skypher

Research by: Aviran Hazum, Alex Shamshur, Raman Ladutska, Ohad Mana, Israel Wernik Introduction Now more than ever, we rely on our smartphones to keep in touch with our work, our families and the world around us. There are over 3.5 billion smartphone users worldwide, and it is estimated that over 85% of those devices – around 3 billion – run the Android OS. Therefore, it is no surprise that criminals and threat actors are actively targeting this vast user base for their own malicious purposes, from trying to steal users’ data and credentials, to planting moneymaking malware, spyware or ransomware, and more. However, from the threat actors’ perspective, gaining a foothold on victims’ mobiles is an evolving challenge, because the built-in security features on some phones, and the controlled access to official app stores such as Google Play do offer a measure of protection to users. This means that would-be attackers have to develop new and innovative mobile infection vectors, and use and refine new skills and techniques to bypass security protections and place malicious apps in official app stores. Check Point Research (CPR) recently encountered a mastermind’s network of Android mobile malware development on the dark net. This discovery piqued our interest, as it was extraordinary, even by dark net standards. CPR researchers decided to dig deeper to learn more about the threat actor behind the network, his products, and the business model behind malicious targeting of Android mobile devices. Deep dive: Journey into the Dark Web We tracked the activity of the threat actor, who goes by the nickname in several Darknet forums. Triangulum, “Triangulum” in Latin means “triangle” and the term is commonly used in relation to the Triangulum galaxy which is a spiral galaxy located in the Triangulum constellation. Just like the Triangulum galaxy, it is hard to spot the traces of the Triangulum actor. But once you spot him, he’s relatively easy to follow. do Profile Nickname : Triangulum™ Skype : triangulum_10 | crook_62 Email : triangulum365@gmail.com Discord : Triang#9504 Alternate identities : Magicroot Alleged origin : Indian Strengths : High level of social skills combined with a math background in trigonometry, integration and differentiation Age : Approximately 25 years old Personal details: - 190cm tall - had two tortoises as home pets back in 2017 - had a girlfriend back in 2017 (current marital status is unknown) Preferable laptop models : Lenovo, HP, Sony, Dell In the past few years that Triangulum has been active in the dark corners of the internet, he has shown an impressive learning curve. Over a two-year period, he dedicated most of his time to evaluating the market needs and developing a merch network from scratch by maintaining partnerships, rooting investments and distributing malware to potential buyers. Triangulum appears to have gotten started at the very beginning of 2017, when he joined the hack forums in the Darknet. Triangulum initially exhibited some technical skills by reverse engineering malware, but at that point in time still seemed to be an amateur developer. Triangulum also communicated with different users, trying to estimate the market value for different kinds of malware. On June 10, 2017, Triangulum provided a first glimpse of a product he developed by himself. Figure 1. Triangulum teaser for the 1st version of his product. This product was a mobile RAT that targeted Android devices, and was capable of exfiltrating sensitive data to a C&C server, as well as destroying local data, even deleting the entire OS. As Triangulum moved on to marketing his product, he looked for investors and a partner to help him create a PoC to show off the RAT’s capabilities in all its glory. Figure 2. Message from Triangulum suggesting investment in his product Figure 3. Looking for a partner. On October 20, 2017, Triangulum offered his first malware for sale. After that, Triangulum vanished from the radar for a period of a year and a half, with no evident signs of activity in the Darknet. Triangulum surfaced again on April 6, 2019, with another product for sale. From this point on, Triangulum became very active, advertising 4 different products within half a year. It appeared that Triangulum had spent his time off creating a well-functioning production line for developing and distribution malwares. Helping hand Maintaining the production and marketing of multiple products in such a short period of time is a tall order, which raised our suspicion that there was more than one actor behind this merch-network. It appeared that someone was helping Triangulum. And indeed, after further digging, we observed evidence that indicated Triangulum was sharing his kingdom with another actor nicknamed . HexaGoN Dev This co-operation seems to have risen from previous deals between the two, as in the past Triangulum purchased several projects created by HeXaGoN Dev, who specialized in developing Android OS malware products, RATs in particular. Figure 4. In the past, Triangulum purchased a few projects created by HeXaGoN Dev. Combining the programming skills of HeXaGon Dev together with the social marketing skills of Triangulum, these 2 actors posed a legitimate threat. Figure 5. HeXaGoN Dev responding to one of Rogue’s customers on behalf of Triangulum. Working together, Triangulum and HeXaGoN Dev produced and distributed multiple malwares for Android, including crypto miners, key loggers, and sophisticated P2P (Phone to Phone) MRATs. Marketing efforts Triangulum advertised his products on different Darknet forums, even using the services of a visual illustrator to design attractive and catchy info brochures for the products. This was a major improvement over his older advertising efforts that looked pretty amateurish. Figure 6. Advertisement of a product for sale in 2017. Figure 7. Advertisements of products for sale in 2019 (DarkShades) and 2020 (Rogue). Despite the fact the malware was sold at affordable prices and with different subscription plans, apparently that wasn’t enough for the Triangulum team. We observed some dirty marketing tricks from the actors. Once, HeXaGoN Dev pretended to be a potential buyer, and commented on one of Triangulum’s posts, promoting the product and praising the development in order to attract more customers. Figure 8. Triangulum responds to HeXaGoN Dev’s comment which was designed to whip up interest on the buyers’ side. It is interesting to note that the team doesn’t want to show demo videos of their products in action. Figure 9. Triangulum explains that a demo video is unnecessary. Reputation We’ve seen indications that Triangulum is obsessed with his reputation and cares about his popularity with the same level of thoroughness as he does about maximizing his profits. He fanatically defends his products and tries to crush anyone brave enough to raise uncomfortable questions about or discredit his work. Figure 10. Triangulum’s arguments in an online dispute. Triangulum’s reputation allows him to be a respected member of the hacking society; he receives a lot of positive feedback and has a high status on his home forum. Figure 11. Triangulum’s reputation on his home forum. Of course, this helps his sales as well: when customers see someone who is a long-term member with many products behind him, together with positive feedback from other users and confident replies by the author, this makes them more inclined to make a purchase. Figure 12. Feedback about Triangulum’s products from users. Customers apparently flock to Triangulum, despite the lack of demo videos, as well as evidence of dirty marketing tricks and some other warning flags. Learning through failure However, as Triangulum soon learned, a good reputation on his home forum does not guarantee automatic success on others. In April 2020, Triangulum attempted to spread his sales network to the Russian segment of the Darknet. He made a post offering one of his products for sale. Figure 13. Post offering one of Triangulum’s products for sale. Despite his previous reputation on his home forum, he didn’t receive a warm welcome here. Users were not ready to pay for the product without a demo video, especially to a relative unknown as he was on this new site. As he did previously, Triangulum stated that he didn’t feel it necessary to provide demo videos. Figure 14. Triangulum suggesting buying instead of trying. After several other increasingly acrimonious posts, the topic was closed with the resolution “Topic-author could not be trusted” with a suggestion to attempt to gain users’ trust. All of this transpired within a period of just 5 days after the topic was opened. Figure 15. Triangulum sales didn’t even get a start on the Russian Darknet forum. What worked well in Triangulum’s home forum didn’t stand a chance in the Russian segment. Triangulum clearly took this lesson to heart, as we have not observed any activity in other Darknet segments since then. Instead of adjusting to customer demands, he stuck to his scheme of what had worked previously, and didn’t want to change it even slightly. Punchline After years of efforts which included trying different marketing techniques that involved authentic sales manipulations, HeXaGoN and Triangulum were now ready to present their latest creation, crown jewel – Rogue. Dissecting the impostor: Taking a peek at the Rogue malware The Rogue malware family is an MRAT. This type of malware can gain control over the host device and exfiltrate any kind of data (photos, location, contacts, messages, etc.), modify the files on the device, download additional payloads and basically anything else that comes to mind. Malware origins Inside the Rogue package, we found two main components. One was what appeared to be malware, and the other one was . What’s so interesting here is that neither of them initially belonged to Triangulum. DarkShades Hawkshaw DarkShades was originally sold in the Darknet by HeXaGoN in . August 2019 Figure 16. DarkShades sold by HeXaGoN. The DarkShades project was officially sold to Triangulum 3 days after the initial sales began, and a new sales thread was created, this time by Triangulum himself. Figure 17. DarkShades sold by Triangulum. What Triangulum did was to embellish the advertisement (see ) compared to the original one. figure 7, to the left Figure 18. DarkShades as originally advertised by HeXaGoN. DarkShades was not the original product developed, as indicated by the name of its main package (“ ”) which is a direct link to another product sold by HeXaGoN earlier that year: . com.cosmos Cosmos RAT Figure 19. Cosmos RAT advertisement; this malware was offered for sale by HeXaGoN. Interestingly enough, this malware was not acquired to be re-sold by Triangulum. Given the fact how methodically he re-sold other HeXaGoN products, this gap is likely due to DarkShades being a superior successor to Cosmos. Thus, re-sale of Cosmos was unnecessary. Regarding Hawkshaw, its malware source code was leaked in 2017 and is available on the web ever since. The version that we discovered inside the Rogue package is “v.1.17”. A summary of Rogue’s genealogic tree is shown in the diagram below: Figure 20. Rogue malware origins. Rogue appears to be the latest iteration in malware developed and maintained by HeXaGoN and Triangulum. However, we cannot call it an entirely new malware family. Rather, it’s the combined version of the Cosmos and Hawkshaw malware families. We also have to add that Triangulum didn’t develop his creation from scratch, but took what was available from both worlds, open-source and the Darknet, and united these components. Technical details Let’s take a look at what the Rogue package has under the hood. Maintaining persistence When Rogue successfully gains all of the required permissions (if all of the required permissions are not granted, it will repeatedly ask the user to grant the missing permissions), it hides its icon as a camouflage defense, making sure it will not be easy to get rid of it. The malware then registers as a device administrator. If the user tries to revoke the admin permission, an onscreen message designed to strike terror in the heart of the user appears: “Are you sure to wipe all the data??” In addition, by comparing specific pre-defined values to ones given by the system, Rogue can detect a virtual environment, which may lead to a delay\abort of its malicious intentions. Figure 21. The malware hides its icon. Networking The Rogue malware family adopted the services of the Firebase platform to disguise its malicious intentions and masquerade as a legitimate Google service. Rogue uses Firebase’s services as a C&C (command and control) server, which means that all of the commands that control the malware and all of the information stolen by the malware is delivered using Firebase’s infrastructure. Google Firebase incorporates a dozen of services to help developers create mobile and web applications. The Rogue malware uses the following ones: “Cloud Messaging” to receive commands from the C&C. “Realtime Database” to upload data from the device. “Cloud Firestore” to upload files. There are multiple types of Firebase accounts hidden in the code of the Rogue malware: GUARDIA OPHOENIX SPITFIRE AVIRTEK HAWKSHAW In addition, depending on the value of the field “APP_VERSION” in the malware’s manifest file, Rogue can run on “MINIMUM” configuration, which as the configuration name suggest, is designed to draw the minimum amount of attention. Below is the full list of commands and capabilities that can be executed by the Rogue malware: Spreading Arms Like many other malicious applications, Rogue can adapt the accessibility service to suit its own needs. The Android accessibility service is the OS assistive service that is used to mimic the user’s screen clicks and has the ability to automate user interactions with the device. Some malwares, Rogue among them, use the accessibility service as the Achilles Heel in Android’s defensive armor to get around OS security restrictions. Rogue uses the accessibility service for logging and documenting the user’s actions and to upload the collected data to the cloud C&C server. Rogue logs the following user actions: TYPE_VIEW_TEXT_CHANGED TYPE_VIEW_FOCUSED TYPE_VIEW_CLICKED Figure 22. Rogue uploads the documented data. In addition, the malware registers its own notification service which is used to sniff every notification that pops up on the infected device. Every notification that is triggered after the implantation of the service, is being saved to a local predetermined database and will later be uploaded to the Firebase Database. The malware saves multiple types of notifications and parses them by splitting each notification into these fields: Message BodySender Timestamp However, notifications from the following list, which usually contain more sensitive and higher value data, are parsed separately: com.facebook.katana com.facebook.orca com.instagram.android com.whatsapp com.skype.raider org.telegram.messenger kik.android jp.naver.line.android com.google.android.gm org.telegram.messenger kik.android jp.naver.line.android com.tencent.mm Figure 23. Rogue saves the notifications. Rogue also maintains a “Block List” for phone numbers. The malware can choose which numbers are in this list, and if it detects an incoming or an outgoing call to one of these numbers, it drops the call. This is done by registering a call receiver called that later uses the handler to block a certain call. me.hawkshaw.receiver.CallReceiver CallBlock Figure 24. Rogue registers the call receiver. On the other hand, when accepting calls, Rogue can record each and every call, incoming or outgoing, and leak it to the Firebase Cloud Store. Figure 25. Rogue listens to every call. Current state of affairs In April 2020, the Rogue RAT package was leaked on one of the Darknet forums. It’s reasonable to assume that the leakage could majorly affect Triangulum’s sales. However, it turns out that the reputation forged on his home Darknet forum does speak for itself; even after the leakage, Triangulum’s team still receives messages on his home Darknet forum from interested customers. figure 26. Message on September 14, 2020 from an interested customer. In fact, at the time this report was written, Triangulum is still active and expanding his customer network. Despite all the obstacles and some failures (like an unsuccessful attempt to start sales in the Russian Darknet segment) along the way, together with HeXaGoN he still distributes malware products through his home Darknet forum. Conclusion The Rogue malware and the story behind it is the perfect example of how mobile devices are exploited. Just like with Rogue malware, other threat actors are practicing and learning, sometimes for years, till they are ready to apply their knowledge as effectively as they can, in either malware development or malware sales. Triangulum shows would-be threat actors that you don’t have to invent new malware every time you want to offer a new product for sale. Instead, you can apply your soft skills in marketing to build up and maintain a sales reputation, and create catchy advertisement and different names for a product that appears to be another version of what already exists. We leave it as an exercise to the reader to compare the two brochures with advertisements of DarkShades and Rogue (see ), and find the differences between them. figure 7 A lesson to draw here is that threat actors have created a reality in which we cannot be complacent. We must stay constantly vigilant for threats that are lurking around the corner and understand how to protect ourselves from them. In any case, if you’re stepping into this arena, you’d better come prepared. In this research, CPR uncovered a fully active market that sells malicious mobile malware, living and flourishing on the dark net and other related web forums. Similar to Triangulum, other threat actors are perfecting their craft and selling mobile malware across the dark Web – so we need to stay vigilant for new threats that are lurking around the corner and understand how to protect ourselves from them. Stay Protected From Mobile Threats Check Point SandBlast is the Mobile Threat Defense (MTD) solution, providing the widest range of capabilities to help you secure your mobile workforce. Mobile market-leading SandBlast Mobile provides protection for all mobile vectors of attack, including the download of malicious applications and applications with malware embedded in them.

The Story Behind The Most Popular Android Malware Distributor on Dark Web

Sometimes, it’s kind of interesting to know the origins of the products/projects we love. I made a collection of such products/projects and the stories of how they got their name. JavaScript (Programming language) From an made to its creator : interview Brendan Eich InfoWorld: As I understand it, JavaScript started out as Mocha, then became LiveScript and then became JavaScript when Netscape and Sun got together. But it actually has nothing to do with Java or not much to do with it, correct? Eich: That’s right. It was all within six months from May till December (1995) that it was Mocha and then LiveScript. And then in early December, Netscape and Sun did a license agreement and it became JavaScript. And the idea was to make it a complementary scripting language to go with Java, with the compiled language. MySQL (Database management system) is one of the founder of MySQL and one of his daughter's name is My(after whom MySQL was named). Michael "Monty" Widenius Git (Version control system) Linus Torvalds (Developer of Git) has quipped about the name git, which is British English slang for a stupid or unpleasant person. Torvalds said: "I'm an egotistical bastard, and I name all my projects after myself. First 'Linux', now 'git'.The man page describes git as "the stupid content tracker". Ubuntu (Operation system) The OS was named after the Southern African philosophy of (literally, 'human-ness'), which Canonical Ltd. suggests can be loosely translated as "humanity to others" or "I am what I am because of who we all are". ubuntu Java (Programming language) The language was initially called Oak after an oak tree that stood outside James Gosling(Developer of Java)'s office. Later the project went by the name Green and was finally renamed Java, from . Java coffee Python (Programming language) In (Developer of Python)'s own words: Van Rossum " " In December 1989, I was looking for a "hobby" programming project that would keep me occupied during the week around Christmas. My office ... would be closed, but I had a home computer, and not much else on my hands. I decided to write an interpreter for the new scripting language I had been thinking about lately: a descendant of ABC that would appeal to Unix/C hackers. I chose Python as a working title for the project, being in a slightly irreverent mood (and a big fan of Monty Python's Flying Circus). Ruby (Programming language) The name "Ruby" originated during an online chat session between Yukihiro Matsumoto (Developer of Ruby) and Keiju Ishitsuka on February 24, 1993, before any code had been written for the language. Initially two names were proposed: "Coral" and "Ruby". Matsumoto chose the latter in a later e-mail to Ishitsuka. Matsumoto later noted a factor in choosing the name "Ruby" – it was the birthstone of one of his colleagues. when name was decided and email they've shared. The original conversation was in Japanese. Translated chat Scala (Programming language) The name Scala is a portmanteau of scalable and language, signifying that it is designed to grow with the demands of its users. Django (Python frmaework) The framework was named after guitarist . Django Reinhardt Chrome (Browser) An answer from Glen Murphy, Design Lead, Google Chrome on asking "How Chrome gets its name?". In his words, " " We had a ‘pick a codename’ vote early in the development cycle – the names that came of that competition were so terrible that we were all pretty happy when one of the leads overrode it and declared that the codename would be ‘Chrome’, presumably because he likes fast cars. Mozilla (Company) The history of the name Mozilla goes all the way back to the internal codename for the original 1994 Netscape Navigator browser, with the name meaning "Mosaic killer" and aiming to some similarity with the building-crushing , as the company's goal was to displace as the world's number one web browser. The name Mozilla was revived as the 1998 open sourcing spinoff organization from Netscape. Godzilla NCSA Mosaic Firefox (Browser) The name "Firefox" (a reference to the ) was chosen by Mozilla for its similarity to "Firebird" (which was the former name of Firefox), but also for its uniqueness in the computing industry. red panda Laravel (PHP Framework) " " — (Creator of Laravel) When trying to think of names, I thought about the geography of Tolkien's Middle Earth and C.S. Lewis' Narnia. In Narnia, Cair Paravel is the name of the castle where the kings and queens of Narnia live. Laravel rhymes with Paravel. I thought the name had a classy and sophisticated ring to it. Taylor Otwell Hadoop (Open source big data software) The name Hadoop is not an acronym; it’s a made-up name. The project’s creator, , explains how the name came about: Doug Cutting “ ” The name my kid gave a stuffed yellow elephant. Short, relatively easy to spell and pronounce, meaningless, and not used elsewhere: those are my naming criteria. Kids are good at generating such. Googol is a kid’s term. Skype (Instant messaging app) The name for the is derived from "Sky peer-to-peer", which was then abbreviated to "Skyper". However, some of the domain names associated with "Skyper" were already taken. Dropping the final "r" left the current title "Skype", for which domain names were available. software Adobe (Company) The name Adobe was derived from Adobe Creek, a river or creek that ran behind the house of John Warnock, one of the founders. But where is Adobe Creek? It's located in Los Altos, California. Apache (Software foundation) According to the FAQ in the Apache project website, the name Apache was chosen out of respect to the Native American tribe and their superior skills in warfare and strategy. The name was widely believed to be a pun on 'A Patchy Server' (since it was a set of software patches). Apache Leave such stories in the comment section if you know about one.

Stories, News & Mentions about SKYPHER

Skypher’s Stories on HackerNoon