Forest Global Training Partners

Cyber Risks · Cisco Talos

DoNot’s Firestarter abuses Google Firebase Cloud Messaging to spread

Summary: Cisco Talos reports that the DoNot APT group, known for targeting Kashmiri non-profit organizations and Pakistani government officials, has adopted a new Android malware loader called Firestarter that uses Google Firebase Cloud Messaging as a mandatory, encrypted command channel. The loader collects the victim's geolocation, IP address, IMEI and email address before the operators decide which devices receive the final payload, and it can be re-tasked through Google FCM even after its hardcoded command-and-control server is taken down.

Bottom line: Because the traffic rides inside Google infrastructure with legitimate certificates, only Google can effectively disable the channel on an infected device, and the operators can push a new payload with no user interaction after law enforcement seizes their C2.

Read the original at Cisco Talos ↗

Topics
Malware
Related