Money Doesn't Stink - Cybercriminal Business Insight of A New Android Botnet

## Overview

Sebastian Garcia, Anna (Avast), and Maria Kawasaki (Czech Technical University) presented research discovering Guest—a new Android botnet targeting Russian users. Discovery mechanism: researchers executed HD Bot (proxy botnet) in lab, intercepted attacker traffic through their proxy, found anomalous SMS data in unicode, decoded Russian language to reveal SMS theft patterns. Scope: estimated 1 million infected devices, ~700 SMS per victim per year. Critical data stolen: banking SMS with OTP passwords (75% of banks send passwords in cleartext), personal information (birthdays, names), account balances. Targets cheap, insecure Android phones (Lava, Meizu, etc.) popular in regions without Samsung/iPhone access or Google Play Store access; infection via social engineering (fake APKs disguised as Flash Player, Google Play, system updates) requesting permissions to read SMS and intercept calls.

## Botnet Infrastructure and Operation

**Command & Control Architecture**: Researchers reconstructed Guest C&C panel (domain down during research, but traffic captures revealed panel structure). Panel displays all infected device information: device ID, OS version, phone operator, country, bank account balance, SMS/call/contact access status. Payment splitting mechanism: attackers use unique identifiers (APK flow values) to track victims acquired per distribution channel—affiliates compensated based on victim count (~20,000 victims per affiliate example). Revenue streams: SMS interception, SIM premium services, click fraud (vApp clicks/app subscriptions causing automatic charges), monetized web traffic (adult video services generate high traffic accessed via infected phones). Infrastructure scale: 17 IP addresses (Russia/Malaysia), unique domain generation resembling DGA (rapid domain rotation for C&C evasion), hundreds of APK samples identified, multiple malware families misclassified on VirusTotal. Victims tracked with granular detail: administrators rights vs. SMS-only access, operator carrier information, active/offline status.

**Attack Flow and Fake APKs**: Distribution uses disguised applications (Flash Player "update", Google Play impersonation, system utilities) leveraging Android's permission system—no exploits needed, purely social engineering. APKs detect emulation environment (prevent analysis), grant sweeping permissions (SMS reading, call interception, contact access, pop-up management), use obfuscated code. Monetization embedded in APKs: click fraud via auto-clicking landing pages, SMS premium subscriptions (victim receives premium service charges without consent), redirected web clicks generating traffic revenue. Defenders adapting: Kaspersky bundled with targeted banks; attackers respond by re-encrypting APKs to bypass antivirus detection using hidden/private FTP services that strip detection signatures.

## Cybercriminal Organization and Social Structure

**Hierarchy and Roles**: Researchers analyzed leaked 6000-message Skype chat log (11 months, ~20 participants, only 10 relevant to Guest) revealing organizational structure: (1) Puppeteers (power_fire)—managers controlling business, payment flows, money laundering contacts, hiring; (2) Developers/Operators (murex, Maxim_chick)—create/modify APKs, operate CNC panel, handle encryption when antivirus blocks APKs; (3) Traffic Operators (Moby_Manx, disloyal_tv, alcohol)—manage SMS premium services, video streaming redirect revenue, traffic purchase/installation monetization. Division of labor: power_fire controls money/payments, murex handles CNC access and APK modification, shared developer pool hired/managed collectively, traffic operators maintain separate revenue streams (SMS premium, app subscriptions, click fraud, video streaming monetization).

**Operational Patterns**: Most conversations occur evening hours (suggesting day jobs or other projects). Trust-based hierarchy: only power_fire and murex have full CNC panel access; other roles compartmentalized. Infrastructure maintenance: weekly domain blocking by Yandex/Chrome requires rapid new domain registration; constant APK re-encryption against antivirus updates; developers hired from freelance platforms with excellent compensation (high-paying jobs attract talent). External threats: power_fire's server hacked (affecting his own infrastructure), indicating attackers vulnerable to reverse intrusion. Anonymity maintained: no identity exchange for upstream financial sources ("they"), payment via shared cryptocurrency wallet, geographic origins unknown, communication obfuscation using Russian slang terminology (Belka = legal accounting, telega = card/channel, blya = swear word).

## Critical Security and Forensic Implications

**Victim Impact**: Extracted 1 million device records indicate bank data theft at scale—75% password leakage via legitimate banking SMS, not exploit vulnerability. Targets economically disadvantaged users (cheap phones, countries without modern smartphone access) systematically exploited via permission-based attack. Geographic concentration (Russian victims) correlates with weak payment card regulation enabling SMS premium fraud. Account balance theft combined with stolen contact lists enables secondary fraud (social engineering of victims' contacts).

**Cybercriminal Economics Insight**: SMS premium and app click fraud more profitable than direct money theft (victims notice balance theft immediately; SMS charges disguised as legitimate telecom/app services). Affiliate payment model incentivizes distribution (affiliates tracked by APK flow, paid per victim)—commoditization of botnet distribution. Hidden services (FTP antivirus-bypass, cryptocurrency payments, Skype communication) reduce operational friction, enabling amateur-level technical skills to participate in organized crime. Chat log reveals criminals apply business management practices (hiring, payments, subcontracting, version control) indistinguishable from legitimate software teams—demonstrates cybercriminal ecosystem maturity.