Operation Blockbuster Goes Mobile
Summary: Unit 42 discovered a new malware cluster targeting Korean-language speakers on Samsung devices, tied to the malware used in Operation Blockbuster, centered on a PE file named JAVAC.EXE that acts as a webserver and serves embedded JavaScript, ELF ARM files, and APK payloads. The APK chain runs from umc.apk to install.apk to object.apk, a backdoor with internal version 4.2.160713, and the samples share the mutex FwtSqmSession106839323_S-1-5-20 and command-and-control IPv4 addresses with previously documented Operation Blockbuster and Destover samples.
Key Takeaway: The reused mutex ties this mobile campaign to the actors behind the SWIFT banking attacks, and the ELF ARM samples hide command and control inside fake TLS sessions that put a legitimate domain in the SNI field while sending traffic to an attacker IP.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026