GoldFactory hacker group attacks ASEAN strip

GoldFactory hacker group attacks ASEAN strip with fake banking app

The money-sucking malware, or Banking Trojan, is although on the news has been quiet and has been replaced by the news of money transfer fraud, but this type of malware has not disappeared, but there are still more new developments every day. Many times it comes in fake bank applications like in this news.

According to a report by The Hacker News website, a campaign has been detected by GoldFactory hackers, a group of hackers from China, attacking mobile phone users in Southeast Asia, covering Indonesia, Vietnam and Thailand, where these hackers are not a new group, but have been operating since 2023. At that time, the group released fake malware applications of the Banking Trojan type called GoldPickaxe, GoldDigger and GoldDiggerPlus. In addition, it was detected that this group of hackers were also involved in malware on the Android system called Gigabud, which also broke out during the same period. Later, in 2024, the group began releasing the same form of malware inside fake banking applications, starting with Thailand and expanding to Vietnam, and then Indonesia.

A research team from Group-IB, a cybersecurity specialist from Singapore, has mentioned the detection of more than 300 samples of fake applications that led to 2,200 malware infections in Indonesia, and after much deeper investigation, the research team found up to 3,000 fake applications that led to 11,000 malware infections. The impersonation of this bank application covers 63% of all bank and financial applications served in Indonesia.

As for the deception method to embed malware into the machine, hackers impersonate a government or major organization with high reliability, send a short message (SMS or Short Message Service), or may use a call to the victim to trick the victim into a messaging application (here is Zalo, a popular Indonesian application) so that the victim clicks a link sent within the application. During the deception, the victim clicks a link to install it, the hacker communicates with the victim to innervate the victim, seducing the victim to give birth in time to mind. The fake app downloaded can lead to downloading. A variety of different species of malware are installed, which can be Gigabud, Gigaflower, Remo, or MMRat. After that, the malware pulls down helper malware like FriHook, SkyHook, and PineHook. These malware are used to control applications or Hooking down to connect to target applications. These two groups of malware have multiple overlapping functions.

1. Hiding a list of applications that have access to Disability Assistance Mode or Accessibility Mode

2. Prevent being detected as using Screencast

3. Spoofing Signature of Android Applications

4. Hiding the source of the installation file

5. Opening the way to use Integrity Token from modified distributors (Providers)

6. Collection of the amount of money in the victim's account (Balance)

The research team also said that the Gigagflower malware, one of the above-mentioned malware lists, is a breakthrough from the Gigabud malware, with support for 48 different commands, such as screen streaming and behavior on the machine to real-time viewing hackers, keylogging, reading the User Interface section, creating a fake update screen to deceive victims, using a fake PIN ID screen to deceive the PIN ID collection from victims, the registration screen creating a fake account to deceive. The victim's data, including the use of an algorithm to collect data from the victim's Identification Card or ID Card, and the latest feature in development is a tool for reading the QR Code. This malware is expected to be used in a campaign in Vietnam where the ID card is used to store the ID card. This malware is currently in testing.

In addition, the research team also revealed the peculiar behavior of such hackers: if a victim is found to be running an iOS mobile phone, they will order the victim to borrow an Android-based phone from a friend or relative to follow the procedure. This behavior is expected to come from a strengthened iOS security system, making malware development difficult to rely on this peculiar strategy.

# Recap 2025 # Take care of yourself # Open statements # Includes IT matters # Hackers