Thread by @verovaleros

Now on the Green Room at #VB2019, @eldracote @anshirokova will present "Geost botnet. The discovery story of a new Android banking trojan from an OpSec error", a work also done with @MaryJo_E !

The Geost botnet was found by investigating the traffic of a different botnet: #htbot also known as proxyback. This htbot botnet offers a proxy service for users in the underground.

The Geost operators were using htbot to access the command and control servers from Geost (thinking they were hiding themselves).

Geost was targeting just 5 banks. Interestingly small.

The key to infection by Geost is the fact that targeted users are used to download applications from websites as the play store may not always be available.

A huge number of victims! Mostly in Russia.

A lot of work by @anshirokova analyzing a chat log of the operators/workers behind Geost: "They are just people" 👈🏽

According to the researchers, Geost may be just one thing the operators work on. They found signs of other techniques for making money, such as redirects and Spam sending among others.

1 installation is roughly 20 rubles, which is 0.3 USD. How profitable is it? 🤔

The #opsec errors lead to this finding:
1. Use of Htbot
2. No encryption in the traffic
3. Hired devs with low opsec
4. Leaked chat log
5. No chat encryption
6. They didn't separate personas

OpSec is hard, as @thegrugq always says.