The record
Written by software from the 1 report below. The points restate them; where one says why it matters, that is Prism's reading, not a reported fact.
- A malicious Android spyware called Corp MDM is currently targeting companies in the logistics sector.
- The malware masquerades as a legitimate system service to steal incoming SMS messages and enable unauthorized call forwarding.
- Threat actors distribute these apps through fake Google Play websites branded as specific logistics companies.
- This activity is part of a broader campaign that includes phishing and Windows-based malware to facilitate cargo theft and financial fraud.
What to watch next
- Future discovery of attribution regarding the reported Russian or Armenian nexus.
- Development of additional malware capabilities that current bugs might be inhibiting.
- Expansion of the campaign beyond the logistics sector using the identified infrastructure.
Who said what1
Only words found exactly in the article are shown, attributed and linked to the line they came from.
Ben Folland
security researcher
1 quote · 1 outlet
“compact surveillance implant designed to exfiltrate newly received SMS content, divert calls, and maintain a hidden foreground service,”
In the article
…uses fake Google Play pages branded as CEVA and TKW Logistics to distribute an Android Package Kit (APK) file that's dressed up as a system service. The delivered app has the package name "com.corp.mdm" Corp MDM is a " compact surveillance implant designed to exfiltrate newly received SMS content, divert calls, and maintain a hidden foreground service, " security researcher Ben Folland said. The malware has been described as narrow by design, lacking in spyware functions typically observed in commercial Android spyware. It's suspected that the threat actor behind the…
Coverage1
All filed from India
Named Russia · Armenia · United States · CEVA · Corp MDM · Google Play · TKW Logistics · Ben Folland · Ctrl-Alt-Intel · Global Profit · Have I Been Squatted · Proofpoint
The 1 report is listed beside the record.
Something wrong?
Say what, and it arrives with this record's address filled in. A correction is welcome.
Ask this story
Answers cite the reports above, or say they can't.