A malware called HummingBad has infected over 10 million Android smartphones according to Check Point, an internet security firm. The cyber security software company first discovered the malware in February.
HummingBad malware is developed by Yingmob, a Chinese cyber criminal group who seems to have an affiliation with a rather legitimate Chinese analytics company. The malware has infected users majorly in China and India. The infection is spreading to other parts of the world, and according to the report, Yingmob controls over 85 million devices but only 10 million are currently infected.
In a post by Check Point:
Yingmob has several teams developing legitimate tracking and ad platforms. The team responsible for developing the malicious components is the “Development Team for Overseas Platform” which includes four groups with a total of 25 employees.
The report explains that the malware first takes control of the device by gaining root access:
HummingBad uses a sophisticated, multi-stage attack chain with two main components. The first component attempts to gain root access on a device with a rootkit that exploits multiple vulnerabilities. If successful, attackers gain full access to a device. If rooting fails, a second component uses a fake system update notification, tricking users into granting HummingBad system-level permissions.
For now, all Yingmob gets from this widespread attack is ad revenue which amounts to about $300,000 per month. Yingmob operates with sophistication and they they ahve already posed threats to iOS devices too in the past.