Cybercriminals are deploying infostealer malware within fraudulent applications aimed at Russian users.
These deceptive apps target anxieties regarding fuel prices, drone strikes, and other pressing concerns for the average Russian citizen, researchers have indicated.
A recent operation targets Russian drivers with an application claiming to map traffic police patrols, speed cameras, and gas stations with available fuel. Instead, this app installs ZloyRAT, an Android trojan capable of accessing functions and gathering sensitive data from compromised devices, according to F6, a Russian cybersecurity firm.
The malware is also spread via two other fake applications: GosuVPN, which promotes itself as a free government-backed service for unrestricted internet access, and Drone Radar, which purports to show real-time drone attacks on an interactive map.
All three applications were promoted through a website registered in early October, and researchers reported that they had requested its blocking within Russia.
This malicious activity coincides with widespread fuel shortages and increasing gasoline costs in Russia, partly caused by sustained Ukrainian drone and missile strikes against Russian oil refineries.
F6 noted that the threat actor behind this campaign remains unidentified. The trojan, ZloyRAT, was first identified by F6 earlier this year. Once installed, it mimics legitimate software and seeks permissions for text messages, contacts, and phone calls, allowing it to send messages and place calls from the infected device.
ZloyRAT also targets data linked to over 60 Russian banking and financial applications, alongside online marketplaces, government services, and the Telegram messaging platform. To mask its presence, ZloyRAT can display a genuine website when users engage with the compromised app, complicating detection of the device compromise.
The campaign aligns with a broader trend of cybercrime capitalizing on Russia's wartime disruptions, specifically concerning fuel availability and drone threats.
Market participants are facing heightened risks as threat actors exploit existing infrastructural vulnerabilities related to wartime economic pressures.
