Rogue Malware on Android: What to know about it

Android Users Watch out for Rogue Malware

By David Lukic
Published: Jan 15, 2021
Last Updated: Mar 18, 2022

Check Point Research reported today that a dark web vendor “Triangulum” has teamed up with another hacker to create a remote access Trojan (RAT) that can take over an Android device stealing photos, contacts, messages, and locations, from apps like Facebook, Instagram, WhatsApp, Skype, Telegram, Kik, Line, and Google Messages.

Rogue Malware

The man selling the RAT appears to be a 25-year-old man of Indian descent, and he opened up shop on the dark web on June 10, 2017.

According to the researchers’ report, “The product was a mobile RAT, targeting Android devices and capable of exfiltration of sensitive data from a C&C server, destroying local data – even deleting the entire OS, at times.”

The latest version of Rogue (v6.2) stems from Dark Shades (v6.0), initially developed by HeXaGoN and purchased by Triangulum. One or both of the hackers combined Dark Shades with pieces of another malware product called Hawkshaw. Dark Shades hails from its origins malware dubbed “Cosmos.”

In their report, Check Point Research said, “Triangulum didn’t develop this creation from scratch; he took what was available from both worlds, open-source and the darknet, and united these components.”

The RAT does not need a computer to execute and, once installed, can take complete control of the mobile device. Unfortunately, this nasty piece of malware has a wide range of features. According to The Hacker News, “Indeed, the RAT boasts of a wide range of features to gain control over the host device and exfiltrate any kind of data (such as photos, location, contacts, and messages), modify the files on the device, and even download additional malicious payloads, while ensuring that the user grants intrusive permissions to carry out its nefarious activities.

It’s also engineered to thwart detection by hiding the icon from the user’s device, circumvent Android security restrictions by exploiting accessibility features to log user actions, and registers its own notification service to snoop on every notification that pops up on the infected phone.”

The product uses Google’s Firebase infrastructure to appear legitimate and operate backend commands.

A Nefarious Partnership

Before marketing the destructive tool, Triangulum went looking for investors back in September 2017. After his initial splash online, he disappeared off the grid for about a year and a half before showing up again on April 6, 2019. When he resurfaced, he had a partner, “HeXaGoN Dev,” and they had a new offering called “Rogue.”

Triangulum’s partner is noted to be an expert in developing Android-based RATs. Triangulum advertises various malware products on forums on the dark web with impressive infographics boasting about the list of features. Rogue malware was initially offered for a one-time fee of $60, but then in 2020, the duo increased the price to $30/month or a lifetime license for $190.

The Hacker News commented that “Interestingly, Triangulum’s attempts to expand to the Russian darknet market were met with failure following the actor’s refusal to share demo videos on the forum post advertising the product.”

Rogue is Not All It’s Cracked Up to Be

According to a tweet on April 20, 2020, Lukas Stefanko of ESET found the backend source code for Rogue and tweeted, “it has a lot of security issues,” and that “it is new naming for Dark Shades V6.0 (same developer).”

As of now, Triangulum is still selling the product on the dark web, and more customers are buying and using it.

How Android Users Can Stay Safe

Android users should be on alert and ever watchful for this new attack medium. Some other ways to stay safe are:

Never install apps and software from untrusted sources.
Use strong passwords on all your accounts.
Secure the phone with a passcode, fingerprint, and facial recognition.
Do not click links in an email, and be careful of phishing scams.
Install good antivirus software on the device and run scans often.

Be on the watch for any type of scam, fraud, or identity theft.

What Is An On-Path Attack and How Does It Work?

Suppose someone left their home, got in their car, and drove to the grocery store. Much like data packets that travel over Internet highways, the car will use various pathways to reach its destination; however, once the car gets to the store, a question remains: what happened between the generating point and the destination?

What is Bait and Switch Scams: How it Works and How to Avoid It

Ever follow an ad featuring limited-time products to a company's web page only to find they're selling something else entirely?

What is Intellectual Property Infringement, and How to Avoid It?

When we think of "property," the first thing that comes to our mind might be tangible objects—items we've purchased, like cars and homes, or entitlements we've procured, like land, titles, or even honorifics.

How to Buy a House with Bad Credit

Buying your own home is the American Dream, but it might seem out of reach to those with bad credit. However, the good news is, if your credit is less than perfect, you do still have options and in most cases, can still buy a home.

How Secure Is Your Password? Tips to Improve Your Password Security

Any good IT article on computers and network security will address the importance of strong, secure passwords. However, the challenge of good passwords is that most people have a hard time remembering them, so they use simple or obvious ones that pose a security risk.

Top 10 Senior Scams and How to Prevent Them

Senior scams are becoming a major epidemic for two reasons. First, seniors often have a lot of money in the bank from a life of working hard and saving.