Lemon Group’s Cybercriminal Businesses Built on Preinfected Devices

Note: This group's name is a generic identification based on components found during our investigation, and it might be used by other legitimately registered companies that legally render services and products. The illicit entity "Lemon Group" identified here should not be confused with legitimate organizations.

Following a report of mobile devices being used for a fraud campaign, we analyzed one of the devices preloaded with two different loaders capable of downloading other components from two different threat groups. In the full research…