GigabudMalware
Gigabud is the name of an Android Remote Access Trojan (RAT) Android that can record the victim's screen and steal banking credentials by abusing the Accessibility Service. Gigabud masquerades as banking, shopping, and other applications. Threat actors have been observed using deceptive websites to distribute Gigabud RAT.From MISP Galaxy
Last reported 1 month ago, by Check Point Research10 reports
ATT&CK techniques
6 of 18 · each with the sentence it comes from- T1684Social Engineering
“Passkey-themed campaign: Microsoft has spotted a pretty complex phishing and social engineering campaign hitting corporate environments using "fix your passkey" type of lures.”
- T1056.001Keylogging
“The latest Gigabud versions contain another feature that abuses accessibility services – a new keylogging module that allows preparing the specific password-stealing scheme for each targeted banking application.”
- T1036Masquerading
“Active since at least July 2022, Gigabud.Loan has been masquerading as applications of fictional financial institutions from Thailand, Indonesia, and Peru.”
- T1657Financial Theft
“…e believe that they are a resourceful team involving numerous individuals in the processes of Trojan development, distribution, and financial theft.”
- T1219Remote Access Tools
“… Identify and monitor suspicious activities within the device environment, including bot activity, the use of hosting services, remote access tools, screen-sharing applications, accessibility services, and overlay activities.”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Software Packing.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
10 reports, newest first · the exact sentence from each-
14th September – Threat Intelligence Report“The Gigabud malware used in the operation was linked to at least 1,469 compromised devices in Indonesia and nearly $1 million in losses.”
-
Risky Bulletin: Anthropic agents went hacking again“Gigabud Android banking trojan: Security researchers have discovered a new Android banking trojan named Gigabud that clones banking apps inside isolated hidden phone profiles.”
-
Gigabud Uses Android App Cloning to Evade Fraud Detection“Gigabud Uses Android App Cloning to Evade Fraud Detection”
-
Vwork: Weaponized Open-source Software as an Addon for Gigabud“Vwork: Weaponized Open-source Software as an Addon for Gigabud”
-
Beyond Tax Returns: How Shared Malware Infrastructure Scales Brand Abuse In Indonesia“First documented in July 2022, Gigabud is attributed to the GoldFactory threat cluster and its operational scope has expanded from Thailand to include the Philippines, Vietnam, Peru, and Indonesia.”
-
Hook for Gold: Inside GoldFactory’s Сampaign That Turns Apps Into Goldmines“The pre-release test version of the new Gigabud variant, dubbed ‘Gigaflower’ by Group-IB researchers, reveals a revamped codebase, features experimental capabilities such as text recognition and QR code scanning for ID card images.”
-
Deepfake Fraud: How AI is Deceiving Biometric Security in Financial Institutions“Similarly, the Android Remote Access Malware Gigabud—which is seemingly developed by the same attackers or an associate—has been found capable of stealing facial recognition data, contributing to digital KYC bypass attempts as well.”
-
Face Off: Group-IB identifies first iOS trojan stealing facial recognition data“…the details of the threat posed by GoldFactory and shed light on its evolving relationship with other Android malware families, such as Gigabud.”
-
Let’s dig deeper: dissecting the new Android Trojan GoldDigger with Group-IB Fraud Matrix“Other noteworthy Android malware families currently targeting the region include the Gigabud family, SpyNote, HookBot, PWNDROID4, CraxsRAT, TgToxic, and Anubis (Godfather’s predecessor), etc.”
-
Breaking down Gigabud banking malware with Group-IB Fraud Matrix“Breaking down Gigabud banking malware with Group-IB Fraud Matrix”
Indicators in its reports
named in the reports above- ks8cb[.]ccin 2 reports
- ms2ve[.]ccin 2 reports
- zu7kt[.]ccin 2 reports
- d8834a21bc70fbe2…e35be1b7276bin 2 reports
- hds6y[.]ccin 2 reports
- smgeo[.]ccin 2 reports
- www.dg1e[.]comin 2 reports
- wbke[.]ccin 2 reports
- idscan[.]netin 1 report
- collusion[.]wikiin 1 report
Copy these 10 indicators · defanged
Thanks — we review every report.