Malicious Android Apps Target Russians with ZloyRAT Trojan Amidst Fuel Shortages

Exploiting Current Events

Cybercriminals are leveraging current events in Russia, specifically anxieties surrounding fuel shortages and drone attacks, to distribute malicious Android applications. These apps are designed to trick users into downloading malware that steals personal and financial information.

ZloyRAT Trojan Distribution

The primary malware distributed is ZloyRAT, an Android trojan. It is delivered through three fake applications: one claiming to show traffic police, speed cameras, and gas stations with fuel; GosuVPN, advertised as a free government-backed VPN; and Drone Radar, which purports to display real-time drone attacks. These applications are promoted via a website registered in early October.

Malware Capabilities

Once installed, ZloyRAT disguises itself as a legitimate app and requests extensive permissions. It can collect text messages, contacts, phone calls, and push notifications. The trojan specifically targets information from over 60 Russian banking and financial apps, online marketplaces, government services, and Telegram. To evade detection, ZloyRAT can display legitimate websites when users interact with the malicious app.

Context and Impact

This campaign occurs as Russia experiences widespread fuel shortages and rising gasoline prices, partly due to Ukrainian drone and missile strikes on oil refineries. While the threat actor remains unknown, the campaign is part of a broader trend of cybercrime exploiting wartime disruptions. Cybersecurity firm F6, which identified ZloyRAT earlier this year, did not disclose the number of downloads or confirmed financial losses.