# RedWing: Android Malware-as-a-Service Spyware Operation Targeting Russian Financial Institutions

> RedWing is a commercial Android spyware sold as Malware-as-a-Service (MaaS) through a Telegram-based subscription platform with tiered pricing, referral discounts, and a bot-driven APK builder. It abuses the Accessibility service and default SMS handler role to deliver banking/crypto overlay phishing, OTP interception, hidden call forwarding (*21*), live VNC screen streaming with keylogging, camera/microphone surveillance, and DDoS botnet capability, targeting 82 financial institutions with a strong focus on Russian banks.

- **Published:** 2026-07-18T00:00:00Z
- **Last reviewed:** 2026-07-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1478
- **ID:** TL-2026-1478
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

RedWing is a fully commercialized Android spyware platform documented by Zimperium zLabs (published 2026-07-07) and operated as Malware-as-a-Service via a Telegram channel and bot. Customers subscribe through tiered pricing plans with a referral program that discounts fees for distributors who recruit new buyers. A Telegram bot automates APK construction: it packages a customer-selected target list of banking/crypto apps, injects an obfuscated dropper, and mimics legitimate app store listings (Google Play, Samsung Galaxy Store, Huawei AppGallery, and Russia's RuStore) complete with forged reviews, download counts, and metadata to lower victim suspicion.

Once installed, the dropper decrypts a second-stage DEX payload from its assets at runtime and requests a sequence of permissions through a fake onboarding flow modeled on legitimate app UX: battery-optimization exemption, default SMS handler role, notification access, device admin, and — critically — Android's Accessibility service, which the malware abuses to read screen content, inject synthetic touch/input events, and dismiss competing prompts. With Accessibility and SMS-handler access established, RedWing deploys fake login overlays (fake activity windows drawn over legitimate banking and cryptocurrency apps) to harvest credentials, PINs, and patterns, and uses regex-based scanning of intercepted SMS/notification text to grab one-time passcodes, card numbers, and CVV codes in real time before forwarding them to the operator panel.

Beyond credential theft, RedWing gives the operator a live VNC-style remote-control channel over the infected device: real-time screen streaming, keystroke logging, and remote command execution (e.g., triggering photo capture or audio recording) through an operator control panel that also exposes real-time device telemetry and lets operators update overlay target lists without re-issuing the APK. A hidden call-forwarding feature abuses the legacy USSD carrier code (*21*) to silently redirect the victim's incoming voice calls to attacker-controlled numbers, defeating voice-based 2FA and bank verification calls, while incoming calls from the victim's bank can be silenced outright. The platform additionally offers a DDoS-for-hire capability: RedWing-infected devices can be pooled into a botnet that issues coordinated multi-threaded HTTP floods against operator-specified targets.

Zimperium assesses RedWing shares droppers and overlay techniques with the previously tracked Oblivion Android malware family, indicating RedWing is a MaaS-commercialized evolution/variant rather than a wholly new codebase. Because APKs are compiled server-side per customer/campaign with a dynamically selected target list and bot-driven obfuscation, static hash-based detection is undermined; Zimperium published a rolling IOC set (APK hashes, phishing domains, and dropper distribution sites) rather than a single canonical sample. The operation shows links to Russian-speaking threat actors and disproportionately targets Russian financial institutions alongside a smaller set of international banks and crypto exchanges, distributed through phishing sites that impersonate legitimate app stores and cloud-storage services (e.g., a fake Yandex Disk page) to seed the initial dropper download.

## MITRE ATT&CK

- T1660 Phishing
- T1474 Supply Chain Compromise
- T1624 Event Triggered Execution
- T1541 Foreground Persistence
- T1406 Obfuscated Files or Information
- T1628 Hide Artifacts
- T1630 Indicator Removal on Host
- T1684.001 Impersonation
- T1516 Input Injection
- T1417 Input Capture
- T1517 Access Notifications
- T1426 System Information Discovery
- T1430 Location Tracking
- T1418 Software Discovery
- T1513 Screen Capture
- T1512 Video Capture
- T1429 Audio Capture
- T1636 Protected User Data
- T1533 Data from Local System
- T1437 Application Layer Protocol
- T1663 Remote Access Software
- T1642 Endpoint Denial of Service
- T1641 Data Manipulation
- T1582 SMS Control
- T1616 Call Control
- T1587 Develop Capabilities
- T1583 Acquire Infrastructure

## Sources

- [RedWing: A Mobile Malware-as-a-Service Operation](https://zimperium.com/blog/redwing-a-mobile-malware-as-a-service-operation)
- [Zimperium IOC repository - RedWing (2026-07)](https://github.com/Zimperium/IOC/tree/master/2026-07-RedWing)
- [RedWing Android Spyware Sold as a Service on Telegram](https://www.infosecurity-magazine.com/news/redwing-android-spyware-maas/)
- [RedWing MaaS Packages Android Bank Fraud as a Telegram Rental Service](https://thehackernews.com/2026/07/redwing-maas-packages-android-bank.html)
- [Telegram-Hosted RedWing Malware Lets Anyone Rent Android Spyware Tools](https://securityaffairs.com/194942/malware/telegram-hosted-redwing-malware-lets-anyone-rent-android-spyware-tools.html)
- [Zimperium zLabs Uncovers RedWing Mobile Malware-as-a-Service Platform Powering Full Android Device Compromise](https://zimperium.com/resources/zimperium-zlabs-uncovers-redwing-mobile-malware-as-a-service-platform-powering-full-android-device-compromise?hs_amp=true)
- [RedWing Spyware (Android) - Removal and recovery steps](https://www.pcrisk.com/removal-guides/35590-redwing-spyware-android)
- [Beyond The Password Theft: New RedWing Android Variant Deploys Hidden Call Forwarding To Intercept 2FA Banks](https://the420.in/redwing-android-malware-telegram-banking-fraud-maas/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1478