Ankura CTIX FLASH Update - May 19, 2023

Malware Activity

Lemon Group Threat Organization Capitalizing on 8.9 Million Pre-Infected Android Devices in Latest Campaign

Researchers have observed the Lemon Group threat organization leveraging previously infected Android devices around the globe to carry out their latest campaign. This activity involves approximately 8.9 million devices that are mainly located in the United States, Mexico, Indonesia, Thailand, Russia, India, the Philippines, South Africa, Angola, and Argentina. Researchers have noted that the infection of Android devices "turns these devices into mobile proxies, tools for stealing and selling SMS messages, social media and online messaging accounts, and monetization via advertisements and click fraud." It is also suspected that threat groups are beginning to utilize additional Android-based Internet-of-Things (IoT) devices, such as smart televisions, television boxes, entertainment systems, and children's watches. Researchers observed