Banking Trojans Masquerading as Government and Payment Apps Target Android Users in Southeast Asia

Since August 2024, a financially motivated threat group has been targeting Indonesian and Vietnamese Android users with banking trojans disguised as government ID and payment apps, according to DomainTools. The operators use spoofed Google Play Store pages and a WebSocket-based delivery mechanism that sends the APK in many small chunks, accompanied by a fake progress bar to evade scanners.

Payloads include BankBot variants, with one sample named IdentitasKependudukanDigital.apk flagged as BankBot.Remo.1[.]origin, a previously closed source trojan whose code leaked in 2016. The group relies on hundreds of domains sharing an infrastructure footprint, including the registrar Gname[.]com Pte. Ltd., nameservers share-dns[.]net and Cloudflare, and hosting via Alibaba and Scloud, with Singapore and Indonesia IPs.

Heatmap analysis suggests domain registration and operational activity within about 10.5 hours, typically during working hours in Eastern Asia. Some campaigns also use open web directories to host APKs named after banking apps such as BCA.apk, BRImo.apk, and Livin.apk.