Ankura CTIX FLASH Update - December 9, 2022

Malware Activity

"Zombinder" APK Binding Service Identified in Hybrid Malware Campaign Targeting Windows and Android

A new hybrid malware campaign has been identified targeting Android and Windows operating systems with various types of malware, including "ERMAC" (Android banking trojan), "Erbium" (desktop infostealer), "Aurora" (desktop infostealer), and "Laplas" (desktop clipper). This campaign involves "Zombinder", a third-party service found on the dark web that uses APK binding to "bind a malicious payload to a legitimate application, in order to trick victims to install it." The campaign has thousands of victims currently, with the Erbium stealer alone exfiltrating data from over 1,300 victims. Researchers noted that a portion of the malware deployments involve fraudulent websites containing malicious Wi-Fi authorization software for Windows and Android. These websites are used to "assist" users in accessing the internet and prompts the downloading of a