One of the most fearsome Android banking trojans has been spotted sporting a major upgrade, making it an even bigger threat.
To make matters worse, BRATA is no longer focused exclusively on Brazilian banks, but has rather set its sights on banks in the UK, as well as Spain, and Italy.
Research from cybersecurity experts Cleafy says the Brazilian Remote Access Tool for Android, AKA BRATA, was observed with new methods of obtaining GPS location data, new ways to send and receive SMS messages, and new ways to obtain much-needed permissions. To top it off, BRATA is capable of deploying additional malware (opens in new tab), as well, with the ability to log events on the target endpoint (opens in new tab).
It uses a separate, but related, app to read SMS messages, getting access to two-factor authentication codes, as well as one-time passcodes. This app is also used to obtain contact details for potential victims in the UK, Spain, and Italy.
Factory resetting compromised devices
The trojan is distributed via phishing SMS messages, claiming to be from the target bank, and carrying a download link, while the entire campaign also comes with phishing pages, pretending to be from the targeted banks.
But perhaps the biggest danger coming from BRATA is the fact that if it is successful in wiping the funds (opens in new tab) from a target account, or if it spots an antivirus (opens in new tab) scanning for it, BRATA will restore the device to factory settings, wiping all contents from the device.
The attackers will first target customers of a specific bank for a few months, and then move on to a different target, researchers said.
“The modus operandi now fits into an Advanced Persistent Threat (APT) activity pattern. This term is used to describe an attack campaign in which criminals establish a long-term presence on a targeted network to steal sensitive information,” Cleafy said (opens in new tab).
“Threat actors behind BRATA now target a specific financial institution at a time, and change their focus only once the targeted victim starts to implement consistent countermeasures against them. Then, they move away from the spotlight, to come out with a different target and strategies of infections,” it concluded.