Thousands of Emulated Mobile Devices Used to Steal Millions of Dollars

What has happened?

• The scope of this attack was very vast, as more than 20 emulators were used to spoof over 16,000 compromised devices.
• An emulator can mimic characteristics of a different kind of mobile device without any need of purchasing them. In this attack, they were abused to spoof compromised mobile devices.
• The data sources, scripts, and customized applications created an automated process that speeds up their attack. It allowed them to rob millions of dollars within a matter of days.

Modus operandi

• The attackers used a tool to feed up device specifications from a database of earlier compromised devices. Then, they matched each spoofed device with the banking credentials of the account holders.
• The attackers were able to even spoof their compromised device's GPS location. They used a virtual private network (VPN) service to mask their malicious activity from the banks.
• After every attack, they shut down their operation, wiped trace, and then prepared for the next attack. In addition, they monitored activity on the compromised banking accounts in real-time.

Conclusion