Enlarge
called out in 2020. Bitdefender said the apps appeared in two waves, one in 2016 through 2017 and again in 2018 through 2020. Mandrake’s ability to go unnoticed then was the result of some unusually rigorous steps to fly under the radar. They included:
- Not working in 90 countries, including those comprising the former Soviet Union
- Delivering its final payload only to victims who were extremely narrowly targeted
- Containing a kill switch the developers named seppuku (Japanese form of ritual suicide) that fully wiped all traces of the malware
- Fully functional decoy apps in categories including finance, Auto & Vehicles, Video Players & Editors, Art & Design, and Productivity
- Quick fixes for bugs reported in comments
- TLS certificate pinning to conceal communications with command and control servers.
Lurking in the shadows
Bitdefender estimated the number of victims in the tens of thousands for the 2018 to 2020 wave and “probably hundreds of thousands throughout the full 4-year period.”
Read 6 remaining paragraphs | Comments
Article Tags:
featuredArticle Categories:
Technology
