Octo2: New invisible Android Trojan attacks Europe

[Friend]

Installing mobile apps has never been so dangerous.

A new variant of the Android malware called Octo2, which is an improved version of Octo (ExobotCompact), is being distributed in Europe. According to ThreatFabric experts, the new version could significantly affect the cybersecurity landscape.

Octo2 is an update to Malware-as-a-Service (MaaS), a malware distributed among cybercriminals. This version features improved capabilities for remote management of the victim's devices and the use of new masking techniques, including Domain Name Generation (DGA), which allows you to bypass security mechanisms and remain undetected.

The Exobot family was first spotted in 2016 as a banking Trojan capable of executing interface overlay attacks, intercepting calls and messages. In 2019, a lightweight version of ExobotCompact appeared, and in 2021, an improved version of it called Octo appeared. It was this version that became the basis for further changes.

In 2022, cybercriminals actively discussed Octo on underground forums. Since then, the activity of the malware has only increased, and soon it began to be used in various regions of the world, including Europe, the United States and Asia.

The main change in 2024 is due to the leak of the Octo source code, which led to several forks of the program. However, the greatest threat is the original Octo2, developed by the creator of Octo and distributed to those who previously used the first version.

Octo2 has introduced significant updates, including stability improvements for remote device management and methods for bypassing analysis and discovery systems. Octo2 also implemented a system that allows you to intercept push notifications from victims' devices and hide them, thereby depriving users of important notifications. This poses a threat to many mobile applications, as attackers can easily redirect data and perform fraudulent actions.

The first campaigns using Octo2 have already been recorded in countries such as Italy, Poland, Moldova and Hungary. The malware masquerades as popular apps such as Google Chrome and NordVPN, which helps sneak into users' devices undetected.

In the detected campaigns, the Zombinder service acts as the first stage of installation: after launching, Zombinder requests the installation of an additional "plugin", which is actually Octo2, thereby successfully bypassing Android 13+ restrictions.

Zombinder Asks for Permission to Install a 'Necessary Plugin' in the Form of the Octo2 Trojan

One of the key elements of Octo2 was the integration of a new method of generating domain names (Domain Generation Algorithm, DGA), which allows the malware to dynamically modify C2 servers. This complicates the work of researchers and antivirus companies, as new domains are created automatically, making them more difficult to block.

In addition, Octo2 uses a new encryption system for data transmitted to management servers, with a dynamic key for each request, which strengthens protection against analysis and detection.

With its improved remote access and stealth capabilities, Octo2 poses a serious threat to mobile users, especially those who use banking apps. The program is capable of silently performing fraudulent operations directly on the victim's device, which makes the malware one of the most dangerous mobile Trojans.

Source

 

[Friend]

ThreatFabric experts have discovered a new version of the Octo banking Trojan, which has been named Octo2. So far, the Android malware is distributed only in European countries and is disguised as NordVPN, Google Chrome and Europe Enterprise applications.

The new variant of the malware is more resilient, has improved anti-analysis and anti-detection mechanisms, and uses a domain generation algorithm (DGA) to communicate with C&C servers.

Recall that the original Octo banker existed from 2019 to 2021 and was created on the basis of the ExobotCompact malware, which, in turn, was a "lite" version of another well-known malware, Exobot, whose source code became public in 2018.

In an analysis of the first version of Octo, ThreatFabric experts wrote that the malware allows its operators to gain broad access to the victim's data. Octo also supported keylogging, device navigation, could intercept SMS and push notifications, lock the device screen, mute sound, launch arbitrary applications, and use infected devices to send SMS.

As researchers have now warned, this year the Octo sources have leaked online, which has led to many "forks" and presumably, and the creator of the malware, known as Architect, has clearly faced a drop in sales. As a result, Architect announced the release of Octo2 and even promised a special discount to users of the first version of Octo.

Currently, campaigns that use Octo2 are targeting users in Italy, Poland, Moldova, and Hungary. However, since Octo2 operates on a Malware-as-a-Service (MaaS) scheme, researchers believe that Octo2 can soon appear in other regions.

It is reported that in European countries, attackers disguise the updated banker as NordVPN (com.handedfastee5), Google Chrome (com.havirtual06numberresources), and Europe Enterprise (com.xsusb_restore3).


Octo2 uses the Zombinder service to add a malicious payload to the APK of applications, thus bypassing the protection mechanisms in Android 13 and later versions of the OS.

According to ThreatFabric experts, Octo2 is more likely to be an updated version of malware, rather than a radically modified malware with code rewritten from scratch.

For example, the developer has implemented a new SHIT_QUALITY setting for the remote access module, which reduces data transfer to a minimum and provides a more reliable connection in case of a poor Internet connection.

Also, Octo2 now decrypts its payload using native code and complicates the analysis by dynamically loading additional libraries at runtime.

And as mentioned above, Octo2 now uses DGA, which allows its operators to quickly upgrade and switch to new C&C servers, which increases resilience against server takeover attempts.

Since Octo2 has not yet been spotted on the official Google Play Store, its distribution appears to be limited to third-party app stores and other sources, which researchers recommend avoiding.