Cyble – Phishing Campaign Targeting Indonesian BRI Bank Using SMS Stealer

MITRE Techniques

• [T1476] Deliver Malicious App via Other Means – Used to deliver APKs via phishing sites to install malicious apps. ‘Deliver Malicious App via Other Means.’
• [T1444] Masquerade as a Legitimate Application – The malware uses the icon of the BRI mobile banking application to appear genuine. ‘The malware uses the icon of the BRI mobile banking application to appear genuine.’
• [T1426] System Information Discovery – Simultaneously, in the background malware collects basic device information such as device name, model number, etc. ‘collects basic device information such as device name, model number, etc’
• [T1402] Broadcast Receivers – Malware registers a SMSReceiver in the Manifest file. ‘The malware has registered a SMSReceiver in the Manifest file.’
• [T1412] Capture SMS Messages – Receiver collects incoming SMS messages and forwards them to C2. ‘receives an SMS… collects the incoming SMSs and sends them to the C&C server’
• [T1411] Input Prompt – Phishing flow prompts users for login credentials and 6-digit PIN. ‘the malicious site prompts the victim to login credentials and 6-digit net banking PIN’
• [T1567] Exfiltration Over Web Service – Exfiltrates captured data to a remote server/C2. ‘sends them to the C&C server’