Seasonal Offer: Free Streaming and TV Services in Exchange for Remote Access to your Device
A cluster involved in the distribution of RATs through paid ads, tracked by our team as Nova YuanKong, has been intensifying its presence in Latin America and the United States.
These ads, initially published on platforms such as Meta Ads, offer users the chance to access free streaming and TV services through suspicious websites.
Once users access the advertised websites, they are tricked into downloading an .APK file, supposedly to gain access to the free streaming and TV service.
The app, initially intended for viewing multimedia content, turns out to be a dropper/loader. Its job is to look like a legitimate app, evade antivirus software, and, above all, install the RAT without raising suspicion. It impersonates apps from well-known brands, such as Netflix, or from banks based throughout the Americas, and is installed via a fake screen that mimics a Google Play update. Once the primary .APK is installed, it decrypts an encrypted vault containing the child file (child.apk), which then installs the RAT.
The RAT requests accessibility permissions, and once it has the required access—through a wireless debugging step that it automates on its own—the operator gains nearly everything they need, such as screen monitoring, data capture, etc.
Websites related to the cluster use names that follow the pattern "brand + app|play|box|hub|media|live|now|pop" under TLDs such as .com, .xyz, .net, .click, or .site.
C2:
ktxapp[.]com - Primary C2
ktx123[.]net - Backup C2
ktx789[.]com - Associated domain
ktx456[.]com - Associated domain
apppanda[.]xyz - Legacy C2
206.82.1[.]14 - C2 IP
墨影 V2 Panel
cctvv3[.]com
cctvv7[.]com
topasd[.]com
g8688808[.]com
baozi1[.]com
