More than 350,000 Android devices impacted by bootkit trojan

Share this article:

A particularly clever trojan has been discovered operating as a bootkit on more than 350,000 Android mobile devices, including a small percentage in the United States, according to a Friday post by Russian anti-virus company Dr. Web.

“To spread the trojan, which entered the Dr.Web virus database as Android.Oldboot.1.origin, attackers have used a very unusual technique, namely, placing one of the trojan components into the boot partition of the file system and modifying the [initialization] script which is responsible for the initialization of OS components,” according to the post.

What that means is that the trojan – which is designed to be able to download, install or remove certain applications on a device, according to the post – is extracted when the phone is turned on, thus making it hard to detect and less likely to be deleted.

According to the post, the threat is compounded because even if some parts of the malware are wiped from the mobile, a certain element will still remain in the system's memory and will reinstall every time the device is rebooted – creating a cycle of infection.

Dr. Web researchers have learned that the trojan is operating on roughly 350,000 devices, the majority of which are in China. A small percentage of victims were said to reside in Spain and an even smaller percentage were said to be in countries such as the United States, Germany and Brazil.  

“Reflashing a device with modified firmware that contains the routines required for the trojan's operation is the most likely way this threat is introduced,” according to the post.

Dr. Web did not respond to an SCMagazine.com request for comment.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

Email promises free pizza, ensnares victims in Asprox botnet instead

Email promises free pizza, ensnares victims in Asprox ...

Cloudmark came upon an email that offers free pizza, but clicking on the link to get the coupon ends with victims being ensnared in a botnet.

Report: most orgs lacking in response team, policies to address cyber incidents

In its Q3 threat intelligence report, Solutionary learned that 75 percent of organizations it assisted had no response team or policies and procedures to address cyber incidents.

Flash redirect campaign impacts Carnegie Mellon page, leads to Angler EK

Flash redirect campaign impacts Carnegie Mellon page, leads ...

Malwarebytes found that, since early July, thousands of sites had been targeted in the campaign.