RedWing: A Mobile Malware-as-a-Service Operation

Executive Summary

The zLabs team has uncovered RedWing, a new Android spyware variant offered as a Malware-as-a-Service (MaaS) through a Telegram channel and appears to have links to Russian threat actors. Malicious operators distribute this rental-based malware through mobile-targeted phishing sites. A substantial number of the associated payloads and droppers currently evade detection by conventional security tools. This discovery looks like a new variant of the oblivion malware, due to the similarity on the dropper stage and some of the overlays used.

RedWing incorporates a broad array of malicious functionalities aimed at data compromise and remote control, including:

• Data exfiltration: Unauthorized access to and extraction of SMS, contacts, call logs and the file system.
• Remote Control: Real-time screen streaming via VNC and remote screen-locking functionality.
• Evasion Mechanisms: Concealment of the application icon to maintain persistence and evade detection.
• Credential Harvesting: The deployment of fraudulent overlays (injects) to harvest sensitive banking and cryptocurrency credentials, with the ability to generate custom injects directly from the command-and-control (C2) panel.
• DDoS capabilities: Launching Distributed Denial-of-Service (DDoS) attacks from the victim's devices.

Threat Assessment

Far from being just another basic piece of malware sold online, RedWing is a fully developed, commercial-grade MaaS product with seller documentation, videos, and a bot-driven subscription model (Fig.1) that provides a low entry barrier for novice attackers. As a proof of this, the APK customization/obfuscation/creation can be fully implemented through telegram.

Fig.1: Telegram bot for building the apk

Through RedWing's Telegram channel, we identified their different business models, from subscription tiers (Fig.2) to a referral scheme (Fig.3) designed to incentivize further distribution of the malware via additional discounts.

Fig.2: Pricing of RedWing Panel

Fig.3: Referral program of RedWing

By deploying fraudulent banking overlays and exploiting SMS permissions to intercept 2FA messages, RedWing poses a severe and direct threat to financial institutions and their customer base, heavily compromising the security of mobile banking operations. Apart from those features, we are going to explain all the options detailed on its channel.

Dropper Constructor

Analysis of the command-and-control (C2) infrastructure reveals a highly customizable 'Dropper Constructor' module utilized to forge the initial infection vector. The panel permits operators to deploy tailored phishing layouts that closely mimic the user interfaces (Fig 4) of prominent app stores, specifically Google Play, the Galaxy Store, and AppGallery or to design fully custom templates. Furthermore, the dashboard provides granular control over the deceptive interface, allowing threat actors to enhance the lure's credibility by seamlessly modifying "application metadata". This includes customizing (Fig 5) user ratings, review volumes, download statistics, developer names, and localized update banners designed to coerce the victim into executing the payload. The resulting appearance of these fraudulent landing pages is illustrated in Fig 6.

Fig.4: Dropper construction panel

Fig.5: Fake reviews to deceive victims

Fig.6: Fake Market places layouts

Malware Customization

Prior to establishing full remote control, the malware must secure an operational foothold on the victim's device. To achieve this, the C2 panel features a sophisticated 'Onboarding Constructor'. Within the 'Stealer' configuration module, operators can deploy a deceptive 'WebView + Cards' interface. This mechanism loads a benign-looking webpage in the background to establish legitimacy, while sequentially overlaying customized permission prompts (cards) from the bottom of the screen (Fig 7). Through tailored social engineering lures, the malware coerces the user into granting critical system access, specifically targeting three core permissions: disabling Battery Optimization (to ensure uninterrupted background execution), setting the application as the Default SMS handler (crucial for intercepting 2FA codes), and access to Notifications.

Fig.7: Overlays to triggered permissions

The malware transmits its granted permissions to the Command and Control (C2) server in real time. This telemetry enables the C2 to determine which malicious commands can be successfully executed on the compromised device as shown in the captured payload:

In the RAT Admin panel the threat actors can fully customize the malicious payload, such as the accessibility service name, its descriptive text to create highly convincing social engineering lures (Fig 8), ultimately tricking victims into granting the Accessibility permission.

Fig.8: Accessibility permission customization

RedWing Malware Analysis

To validate the malware features offered in its administration panel and its Telegram channels, an analysis was conducted on one of the distributed samples. This artifact clearly demonstrates the practical implementation of the configurations defined within the control panel. The analyzed application serves as the final payload; upon execution, it actively requests the aforementioned onboarding permissions (Fig.9), in addition to the critical Android Accessibility Service. It should be noted that the initial dropper responsible for sideloading this specific payload in this case is simulating the RuStore market.

Fig.9: Malware dropper and payload app

Full Screen Manipulation

The malware's Command and Control (C2) server exhibits sophisticated screen manipulation capabilities (Fig. 10), ranging from capturing screenshots to deploying deceptive overlays. These overlays are strategically used to harvest device PINs or project fake loading and update screens designed to restrict user interaction.

To achieve this level of screen control, the malware leverages a variety of internal commands. For example, the <show_overlay> command allows it to inject custom layouts, while commands such as <long_click> and <swipe> are used to seamlessly simulate genuine user interactions. A comprehensive list of these commands can be found at the end of this blog post.

Fig.10: Different overlay’s on top of screen controlled by RedWing

System File Enumeration and Victim Application Management

The spyware gains comprehensive access to all files on the targeted device (Fig. 11). Furthermore, it can remotely execute any application from the victim's list of installed apps.

By utilizing the <open_app> or <open_url> commands, the malware can launch a specific package name or URL received from the server, executing them via Android Intents.

To harvest device data, the malware uses the <get_files> command to enumerate all files within the /sdcard directory. It then bundles the information about these files into a JSON payload and uploads it to the server.

Fig.11: C2 panel providing a comprehensive view of the files residing on the compromised device

Real-Time Surveillance: Audio and Camera Capture

The malware is capable of remotely activating the cameras and the microphone of an infected device (Fig. 12). This functionality is executed via specific commands. For instance, the <take_photo> command allows the attacker to remotely capture images using the device's camera. Similarly, the <start_recording> command leverages the MediaRecorder API to capture ambient audio. This audio recording process is managed entirely from the remote server, which allows the attacker to configure the exact duration of the recording, among other parameters.

Fig.12: Live capturing of victim’s audio and video

Exfiltration of PII info: SMS, Contacts, Call Logs, and Device Metadata and more

The spyware is designed to exfiltrate a comprehensive range of data from infected devices, specifically targeting SMS messages, contact lists, and call logs (Fig.13). Its capabilities extend beyond mere data theft; it can actively interfere with the victim's communications by forwarding incoming calls, sending unauthorized SMS messages, and triggering push notifications. Additionally, the malware has the functionality to track the victim's precise geographic location.

Fig.13: Different capabilities of the malware

In the captured network traffic (Fig. 14), we can observe the malware issuing the <get_phone_number> and <ussd_request> commands. These are utilized to exfiltrate the device's mobile number and query the prepaid account balance.

Fig.14: Example of Commands received from the C2

The malware possesses the capability to intercept incoming voice communications by silently establishing unconditional call forwarding. Upon receiving a specific command from the C2 server <call_forward_set>, the malicious app executes hidden USSD requests (using the *21* code) to redirect all of the victim's incoming calls to an attacker-controlled number. This effectively neutralizes voice-based Two-Factor Authentication (2FA) and allows attackers to bypass bank fraud-prevention phone calls.

Overlay Attacks: Harvesting Banking and Crypto Credentials

The malware distinguishes itself through the deployment of both pre-configured and bespoke phishing windows (Fig.15) aimed at financial entities.

From our research, we identified 82 institutions being targeted from different market verticals with a strong focus on Russian financial institutions. However, the list of targeted apps can be modified from the admin panel, allowing attackers to target new apps without distributing new versions of the malware. The categories of targets are shown in Fig 16.

Fig.15: Banking/Crypto phishing windows

Fig. 16: RedWing target distribution

From our research, we observed that RedWing uses the <request_draw_over> command to obtain the android.settings.action.MANAGE_OVERLAY_PERMISSION. This allows it to display fake overlays whenever a target application is launched.

The malware exploits Android's Accessibility Services in conjunction with Regular Expressions (regex) to continuously monitor for sensitive information. The threat actor employs targeted regex patterns to automatically extract specific data types, including:

• ^\d{4,8}$ : OTPs, PINs, and short authorization codes
• ^\d{13,19}$ : Primary Account Numbers (Credit/Debit Cards)
• ^\d{3,4}$ : CVV/CVC values
• ^\+?\d{10,15}$ : International phone numbers

Despite the sophisticated obfuscation techniques employed, the target list for the Accessibility Service is hardcoded directly within the malware's source code. This architecture strongly suggests that the malicious APKs are dynamically compiled server-side only after the threat actors have defined their specific targets for a campaign.

Live Screen Control via VNC

By leveraging remote desktop-style capabilities, RedWing allows an attacker to monitor and manage a victim's device screen in real time. The malware utilizes the MediaProjection API to record the display, which is then encoded and sent to a specific Command and Control server.

The malware contains several commands (<vnc_XX>) designed to handle the VNC session. For example it deploys a real-time keylogger to capture and exfiltrate all on-screen activity and user interactions and send that information via Websocket to the Server (Fig. 17).

Fig.17: Keylogger sending information of my device

DDoS attack from victim's device

RedWing has the capability to turn infected mobile devices into a coordinated "botnet" to launch Distributed Denial-of-Service (DDoS) attacks directly from the victims' handsets. By flooding a target server or network with a massive surge of traffic, the malware can effectively cripple its operations. As shown in Fig 18, the RedWing control interface allows attackers to execute simultaneous DDoS strikes across all compromised devices against a specific target URL.

Fig.18: DDoS attack infrastructure from RedWing

MaaS Infrastructure

Through RedWing's Telegram channel, we also observed the malware developer announcing a centralized control panel for managing phishing campaigns across various messaging platforms (Fig.19). This upcoming infrastructure appears designed to streamline the distribution of deceptive content, facilitating large-scale credential harvesting and the centralized management of compromised accounts.

Fig.19: RedWing’s telegram channel new phishing feature announcement

Zimperium vs RedWing

The rapid rise of Malware-as-a-Service (MaaS) operations like RedWing shows how easily attackers can weaponize legitimate Android components to achieve full device compromise. Unlike older banking trojans that rely solely on overlays, RedWing integrates custom droppers, live screen streaming, and abuse of the SMS handler role and Accessibility to exfiltrate data and impersonate legitimate apps in real time. This blend of social engineering and hijacking the incoming calls makes this deep-system control especially dangerous in BYOD and consumer-facing environments where app-store trust is assumed.

Zimperium's Mobile Threat Defense (MTD) and Mobile Runtime Protection (zDefend) provide on-device, behavioral detection that identifies RedWing and similar droppers the moment they are installed on the device without requiring cloud look up. Our dynamic detection engine provides zero-day protection even as threat actors repackage and resell the same core toolkit under new brands.

Moreover, our Web Content Filtering engine can detect malicious traffic and prevent the end user from being lured into the malicious website containing the malware. At the same time, zDefend customers can rely on fraud detection indicators (such as screen sharing active) in order to detect malicious activity happening on the device and effectively prevent credential theft.

As MaaS offerings continue to evolve, enterprises must treat every mobile device as a potential entry point.

Zimperium's mission is to stay ahead of these campaigns, providing continuous, on-device defense against both current and future iterations of Android remote-access and espionage malware.

MITRE ATT&CK Techniques

IOCs

RedWing IOCs can be found in this Github repository.

Complete List of Commands Used by the Malware

The table below provides a comprehensive list of commands utilized by the malware, detailing their functions and the capabilities they enable on compromised devices.