BlankBot Trojan Targets Turkish Android Users

A threat intelligence firm discovered samples of a malicious Android program that appears to target Turkish-language speakers. The program can take screen grabs, capture keystrokes, and create custom overlays — also known as Web injections — that can fool users into entering sensitive information.

The Trojan, dubbed BlankBot, appears to be under active development — judging from a significant number of code variants and log files — and remains largely undetected by the anti-malware scanners hosted on VirusTotal, cyberthreat-intelligence firm Intel 471 stated in its report published on Aug. 1. The developers of the Trojan use openly available libraries for mimicking account pages and producing other overlays and showed other signs of cybercriminal sophistication, Intel 471's analysts, who asked not to be named, said in an email interview.

"The developers appear to be experienced Android application developers, and they also demonstrate an understanding of the ATO [account takeover] business," they said. "These libraries allow the malware operators to imitate real financial applications more closely and create a seamless, authentic-looking phishing page, making it more likely that a user will follow all the steps and give up their sensitive information."

At this point, the motive for the group's targeting of Turkey is unclear, the company said. In recent years, Turkey has become a target for cyberattackers, especially nation-state espionage groups. India's SideWinder group has targeted individuals in Turkey — in addition to the group's typical targets of regional rivals, such as Pakistan — while China's APT41 has targeted global shipping, technology, and automotive industries, including those in Turkey.

Meanwhile, the country has been developing its own cyber capabilities. A Turkey-linked group has targeted Kurdish opposition groups throughout Europe, the Middle East, and North Africa, while another cybercriminal group in Turkey is targeting corporate databases in the United States, Europe, and Latin America with ransomware.

Malware Under Development

The malicious application appears to be under development but already has a host of features. Like other Android malware, BlankBot requests permission and then uses Android's accessibility features to take control of the device. Once in control, the malware can record the screen via the MediaProjection API, with the recording saved as JPEG images, which are then sent to a remote server.

In a relatively rare technique, the malware also creates its own keyboard for input, so the application can more easily capture user keystroke input. BlankBot also uses two open source libraries, CompactCreditInput and Pattern Locker View, to create screens that mimic the data entry pages for various sensitive credentials, such as usernames, passwords, PIN combinations, and credit card information, Intel 471 stated in its advisory.

Finally, using the accessibility services, the company said that the malware can control certain features by spoofing finger swipes.

"Threat actors are able to perform on-device fraud (ODF) by waking up and controlling the device remotely with different types of supported gestures, such as clicks or swipes," the advisory stated. "Additionally, BlankBot is capable of creating overlays, as described in the previous section, as well as collecting contacts, SMS text and a list of installed applications."

Focused on Cybercrime

The malware's lineage is still a question mark. While Turkey-linked groups have not shied away from sophisticated attacks against the country's rivals, Intel 471's analysts say the malware seems more likely targeted at financial gain through cybercrime.

"We're fairly certain that this malware was not written for espionage because it has all of the features required for account takeover for financial gain, such as overlays for popular financial applications," the analysts said in an email interview. "Some of those features have limited use for espionage purposes but would make the malware more likely to be detected by anti-malware products."

However, the malware has anti-analysis capabilities, such as obfuscated code and a feature for detecting if it runs in an emulator.

Finally, while Turkish language strings do appear in the code, the malware could easily be localized to target other users and mimic other institutions, Intel 471 stated in its advisory.

"[N]o specific financial institutions were identified as targets during our analysis, therefore, this malware could be distributed in campaigns against users in different countries," the advisory stated.