What happened
Researchers at F6 identified three counterfeit Android applications—promising traffic‑police locations, a government‑backed VPN, and a real‑time drone‑strike map—that, once installed, drop the ZloyRAT trojan. ZloyRAT requests SMS, contacts, and call‑log permissions, can send messages and place calls, and extracts credentials from over 60 Russian banking and financial apps, as well as from government portals and Telegram. The apps are advertised on a website launched in early October and shared in online communities for truck drivers, taxi operators, and delivery workers. No download figures or confirmed financial losses were disclosed, but the trojan’s capabilities indicate a high risk of credential theft and fraud.
Why it matters for trust and compliance
- The incident tests the control area of mobile device access management and highlights the need for continuous security‑awareness training to mitigate socially engineered app installations.
- Demonstrate control over mobile app vetting and permission reviews to satisfy access‑control objectives across NIST CSF and ISO 27001.
- Collect continuous evidence of prohibited app installations for audit‑readiness and third‑party risk monitoring.
Who is affected
FIN_SERV TECH_SAAS
Recommended actions
- Implement MDM policies that block unsigned or unvetted Android apps.
- Run regular security‑awareness training focused on fake‑app scams and permission abuse.
- Monitor device logs for anomalous permission requests and outbound C2 traffic.
- Maintain an approved‑app inventory and enforce installation from trusted stores only.