Chinese cybercriminals have been using full-service mobile malware frameworks to steal money from popular finance apps.
On June 18, China’s National Cybersecurity Reporting Center issued a warning on WeChat to the general public. Cybercriminals were masquerading as provincial public security services, spreading a fake app that promised citizens “one-stop handling” of public safety issues online. Anyone who downloaded the app unwittingly infected their mobile device with information-stealing malware. The warning also listed two IP addresses associated with the campaign.
Those IP addresses led the independent researcher NetAskari, and hunt.io, down a rabbit hole. At the end of it was a substantial cybercriminal ecosystem built around a sophisticated, all-in-one malware-as-a-service (MaaS) builder called “Flying Eagle.”
White Glove MaaS With Flying Eagle Cybercrime Kit
Flying Eagle supplies all the infrastructure and features any ordinary hacker would need to build their own easy mobile malware campaign. Nowhere is this point more obvious than in how it’s distributed. Instead of files on some server somewhere, Flying Eagle is packaged as a complete Docker deployment. Every user gets their own goodie bag with a Web server, a WebSocket server, PHP, and MySQL.
“Docker as a concept invites itself to cybercriminals as much as normal software developers,” NetAskari tells Dark Reading. “Especially if you are in the business of deploying fast, lowering the bar for entry, etc., Docker makes a lot of sense. It keeps things clean, you can deploy it at almost any remote server with little investment in time or adoption.”
Besides the necessary Docker components, users get Android Package Kit (APK) and software development kit (SDK) build tools. It includes Java 11, and a default Transport Layer Security (TLS) certificate. And it offers a variety of phishing templates, including those that mimic TikTok, popular adult services and financial apps, and public welfare projects.
NetAskari marvels at the flexibility and ease of use of modern MaaS offerings. “What I found quite fascinating is how comfortable and modular those kits are by now. Graphical user interfaces (GUIs), clear structures and workflows, templates, ready-to-deploy frameworks. It doesn’t really require a lot of skill anymore to set up modest systems to launch, breach, and extract data from average hardened devices. This is clearly tailored more toward ordinary criminals than sophisticated hackers,” he says.
MaaS In-Depth: A Look at Flying Eagle’s Talons
When the researchers stood up a test instance of Flying Eagle, they found that within the APK builder, the developers included a variety of features for helping users evade static detection out of the box. For example, it conceals names of classes in its code that might tip off antivirus (AV) engines, and it ensures that each new sample of Flying Eagle malware is unique by replacing its hardcoded package name with a randomly generated but seemingly legitimate name such as “com.cloud.manager.core.”
“The evasion work on the APK builder is what I keep coming back to,” says hunt.io head of research Esteban Borges. “To pad out its samples it avoids random bytes, which can trip antivirus heuristics, and instead injects a few megabytes of Base64 JSON dressed up as SDK config caches. That keeps entropy low and looks like ordinary app data, and the developer even left a comment saying that was the point.”
Flying Eagle samples can steal a wide variety of data off mobile devices, including payment credentials and screengrabs. They support keylogging and camera access. They can abuse accessibility services to escalate privileges, and inject overlays into government, pornographic, and financial services apps.
The Chinese Cybercriminal Underground & Night Dragon
Originally, Flying Eagle was shared within closed circles. It only leaked into the wider Chinese cybercriminal ecosystem earlier this year. Shortly thereafter a Telegram channel was created to leverage the situation, called “SQLRCE0,” which helped spread the tool, offer technical support to users, and market a “repaired” version of the original for $2,000 in Tether cryptocurrency. A couple of months later, a second major Telegram channel was formed to do some version of the same thing.
In the spring, when the Chinese government spread its warning about Flying Eagle-generated fake apps, SQLRCE0 was ready with a response. Five days after the notice went out, it released a new Android remote control kit called “Night Dragon.”
To date, Night Dragon is nowhere near as popular as Flying Eagle. The researchers could only find a couple of active servers running it, compared to its predecessor’s hundreds. Yet it might be the more advanced of the two. It can capture live views of victims’ screens, their microphones’ audio, and their cameras. It can access SMS messages, photo galleries, and other files. It injects overlays into popular Chinese finance apps like AliPay and WeChat, cryptocurrency wallet platforms, and major state-owned banks’ apps, including the Agricultural Bank of China, China Construction Bank, and the Industrial and Commercial Bank of China (ICBC). To keep all this mischief a secret, Night Dragon hides its own app icon, and lets attackers force display an artificial black update screen to victims while they’re performing hands-on activity.
“China is the country of ‘big numbers’ that also applies to cyber criminals. The cybercrime environment is probably the most diverse in the world,” NetAskari says. “Despite being the world’s biggest surveillance state, China still struggles to eradicate it. But they are making progress.”
