There is a large global market for low-cost Android devices. Criminals are aware of this and are meeting the demand through devices based on MediaTek platforms – albeit with malware pre-installed in the device firmware.
When the recipient of such an affected device turns it on, the malware is present, invisible and available to any attacker who can remotely control it from their C2. It is a permanent, pre-installed firmware system app that cannot be removed through normal uninstallation procedures.
The campaign called “Midnight Mimosa” was discovered and analyzed from Bitdefender.
The potential for this type of malware infection controlled via the actor’s C2 is enormous. “The malware runs with system-level permissions that allow it to silently install and remove apps, grant permissions, and load arbitrary remotely deployed code. This essentially means its operators can install and delete apps at will and customize any device to their needs, including engaging large botnets,” the Bitdefender report said.
Midnight Mimosa focuses on ad fraud, automated click fraud, and turning the device into a single component of a much larger botnet. This makes sense for a campaign that aims to fly under the radar with an army of soldiers. Many thousands of click fraud cases over a period of time would provide a healthy ROI to any malicious perpetrator. And botnets are described as a hot commodity that can be rented out to other malicious actors. The larger the botnet, the higher the reward.
Over the past two years, Bitdefender has observed thousands of unique affected devices in more than 150 countries. No single country or region dominates the distribution. Mexico and France are at the top, followed by Italy, the USA, Germany, Brazil and Spain. Regionally, Western Europe and America stand out. The report gives no indication of the actual financial gain that Midnight Mimosa operators made, but does provide a detailed list of IoCs to prevent this from happening.
Bitdefender also found 13 apps on Google Play with separate signing certificates under two developer accounts that contain the same Midnight Mimosa ad fraud code. “The campaign is not limited to pre-installed firmware. Thirteen applications published on Google Play were found that carried the same family tags as the published cover apps in builds distributed by Play itself,” the researchers note.
These Play Store apps do not have the same privileged access as the pre-installed malware, but are considered connected to the broader ecosystem, giving attackers an additional distribution channel.
Regardless of whether the malware is pre-installed or downloaded from the Play Store, it has been observed to disable the Play Store before installing additional payload applications and then re-enable it – likely to avoid detection by Play Protect. “The plugins not only suppress the installation prompt, but also hide Google Play Protect for the duration of the installation,” the researchers note. “The malicious installation occurs in a window where Google Scanner is turned off.”
Midnight Mimosa is best viewed as a supply chain threat, where malware is largely integrated into the Android device before sale. The campaign features pre-installed persistence, system-level control, ad fraud activities, proxy network abuse, and remote payload management. Attackers have complete control over affected devices from the start.
Related: The Android Trojan RatHat uses AI for automation
Related: Fraudulent Android apps exploit Google Play’s early access to avoid reviews
Related: New BTMOB Android malware enables complete device takeover
Related: Mirax RAT targets Android users in Europe
