Actu
From HummingBad to Worse
July 2016 by Check Point
For five months, Check Point mobile threat researchers had unprecedented access to the inner-workings of Yingmob, a group of Chinese cyber criminals behind the HummingBad malware campaign. HummingBad is a malware Check Point discovered that establishes a persistent rootkit on Android devices, generates fraudulent ad revenue, and installs additional fraudulent apps.
Yingmob runs alongside a legitimate Chinese advertising analytics company, sharing its resources and technology. The group is highly organized with 25 employees that staff four separate groups responsible for developing HummingBad’s malicious components.
Other research firms have associated Yingmob with an iOS malware called Yispecter, but the evidence Check Point researchers found confirms the same group is also behind HummingBad:
– Yispecter uses Yingmob’s enterprise certificates to install itself on devices
– HummingBad and Yispecter share C&C server addresses
– HummingBad repositories contain QVOD documentation, an iOS porn player targeted by Yispecter
– Both install fraudulent apps to gain revenue
Yingmob uses HummingBad to control 85 million devices globally to generate $300,000 per month in fraudulent ad revenue. This steady stream of cash, coupled with a focused organizational structure, proves cyber criminals can easily become financially self-sufficient.
Emboldened by this independence, Yingmob and groups like it can focus on honing their skill sets to take malware campaigns in entirely new directions, a trend Check Point researchers believe will escalate. For example, groups can pool device resources to create powerful botnets, they can create databases of devices to conduct highly-targeted attacks, or they can build new streams of revenue by selling access to devices under their control to the highest bidder.
Without the ability to detect and stop suspicious behavior, these millions of Android devices and the data on them remain exposed.
