Risk:
| high |
Damage: |
|
Platform(s): |
Android OS |
Advisory ID: |
|
Version: |
|
CVE: |
|
Published: |
|
Summary
ngCERT is issuing an alert on the Android systems compromised by multiple malware families, including Android Backdoor, Prizmes (BADBOX-related), Hummer (HummingBad), Rootnik, Triada, and Uupay. These malwares leverage vulnerabilities The combined impact of these malware variants is severe, with consequences including loss of sensitive data, financial fraud, device instability, large-scale botnet participation, and erosion of user trust in mobile ecosystems. Given the widespread use of Android devices across the nation, ngCERT strongly urges government agencies, enterprises, and individuals to promptly apply the latest security patches and adopt proactive security measures to mitigate these threats.
Description & Consequence
The aforementioned malware families compromise devices through firmware pre-installation, repackaged apps, or malicious downloads from third-party sources, exploiting the supply chain or user installations. Capabilities include rooting for privilege escalation, data exfiltration, ad fraud, credential theft, SMS interception, and backdoor access. Variants like Triada and Prizmes/BADBOX embed in system partitions for persistence post factory reset, while Hummer and Rootnik leverage exploits such as CVE-2012-6422 and CVE-2013-6282 for rooting, and Uupay enables ad pushing and data collection. Once root access is gained, injections into system processes like Zygote is carried out for persistence. This further enables activities such as data theft, credential interception, ad fraud, botnet integration, remote control, additional malware deployment, and evasion of security measures.
Successful exploitation may result in:
- Unauthorised access to sensitive data (IMEI, device ID, contacts, SMS, credentials).
- Financial fraud through ad-click manipulation.
- Device instability due to unwanted apps, excessive ads, and network traffic.
- DDoS attacks, proxy abuse, and disinformation campaigns.
- Persistent backdoor access enabling long-term exploitation.
Solution
Organisations and individuals are strongly advised to:
- Ensure Android OS and security patches are up to date.
- Limit downloads to official stores like Google Play Store and activate Google Play Protect for real-time scanning and threat detection.
- Deploy reputable antivirus/EDR tools with behavioural analysis to identify rooting attempts and anomalous activities.
- Examine new devices for pre-installed malware.
- Implement Multi-Factor Authentication (MFA).
- Enforce Mobile Device Management (MDM) policies to restrict unauthorised apps.
- Educate users on risks of third-party app stores and phishing campaigns.
Reference
Revision
