RemControl Android Banking Trojan Targets Italy and France via Fake TVTap IPTV App

Key facts

Detection coverage

As of 2026-09-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2625 across Splunk SPL, Microsoft KQL and Sigma, covering 37 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: RemControl Fake TVTap Distribution Domain & Dropper Download (SPL)

Detects DNS resolution, proxy, or firewall traffic to RemControl's geofenced fake TVTap IPTV Google-Play-styled landing pages and the direct /dl.php APK download endpoint used to deliver the dropper. These domains were registered 2026-07-10 and have no legitimate use outside the campaign.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1660, T1655, T1655.001, T1627.001
• Data sources: dns_logs, proxy_logs, firewall_logs, web_traffic
• Severity: high
• Confidence: high

Splunk SPL

index=network (sourcetype=stream:dns OR sourcetype=pan:threat OR sourcetype=proxy OR sourcetype=stream:http)
(dest_domain IN ("tvtap-hd.app","tvtap-liveapp.com","vpn.doneplay.site","ff-de.shutgpt.ir","vpn.askarzadeh.com","cdn.dlmafi.top") OR query IN ("tvtap-hd.app","tvtap-liveapp.com","vpn.doneplay.site","ff-de.shutgpt.ir","vpn.askarzadeh.com","cdn.dlmafi.top") OR url="*tvtap-liveapp.com/dl.php*" OR dest_ip="216.126.229.216")
| eval mobile_carrier_geo=if(match(src_ip,"^(?:IT|FR|ES|PL|PT|CA)-"),"targeted_region","other")
| stats count min(_time) as first_seen max(_time) as last_seen values(url) as urls values(user_agent) as user_agents by src_ip dest_domain dest_ip
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let RemControlDistributionDomains = dynamic(["tvtap-hd.app","tvtap-liveapp.com","vpn.doneplay.site","ff-de.shutgpt.ir","vpn.askarzadeh.com","cdn.dlmafi.top"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (RemControlDistributionDomains) or RemoteIP == "216.126.229.216" or RemoteUrl has "/dl.php"
| project Timestamp, DeviceName, DeviceId, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Attempts=count() by DeviceName, RemoteUrl, RemoteIP
| order by Attempts desc

Sigma

title: RemControl Fake TVTap Distribution Domain or Dropper Download Endpoint
id: 7a1e3c9d-4f2b-4a6e-9c1d-8e2f5b7a1c30
status: experimental
description: Detects DNS/proxy/firewall traffic to RemControl's fake TVTap IPTV distribution domains and dropper download endpoint
references:
  - https://www.group-ib.com/blog/remcontrol-android-banking-trojan/
author: Threadlinqs Team
date: 2026/09/23
tags:
  - attack.initial-access
  - attack.t1660
  - attack.defense-evasion
  - attack.t1655
  - attack.t1655.001
  - attack.tool.remcontrol
logsource:
  category: proxy
  product: network
detection:
  selection_domain:
    c-uri|contains:
      - 'tvtap-hd.app'
      - 'tvtap-liveapp.com'
      - 'vpn.doneplay.site'
      - 'ff-de.shutgpt.ir'
      - 'vpn.askarzadeh.com'
      - 'cdn.dlmafi.top'
  selection_path:
    c-uri|endswith: '/dl.php'
  selection_ip:
    dst_ip: '216.126.229.216'
  condition: 1 of selection_*
falsepositives:
  - None expected; these are dedicated malicious campaign domains with no legitimate use
level: high

Known false positives:

• None expected in normal enterprise traffic — these are dedicated malicious distribution domains registered 2026-07-10 with no legitimate function

Tuning notes: Maintain the domain/IP watchlist as a lookup table refreshed from threat-intel feeds since new distribution infrastructure rotates roughly monthly; if geolocation data is available, prioritize alerts where the source GeoIP falls in Italy, France, Spain, Poland, Portugal, Canada, or GCC mobile carrier ranges since the campaign server-side geofences delivery to those regions.

• 🔒 RemControl Known Dropper/Payload APK Hash Match on Managed Devices (KQL) · unlock with TL Creds
• 🔒 Accessibility-Driven Overlay Injection, Keylogging & Self-Preservation Dismissal (KQL) · unlock with TL Creds
• 🔒 Sustained Encrypted WebSocket Session to RemControl C2/Panel Indicative of Live Screen Streaming (KQL) · unlock with TL Creds
• 🔒 RemControl TVTap Impersonation Landing Page Access (Sigma) · unlock with TL Creds
• 🔒 Live Screen-Streaming Session Initiated via Abused Accessibility Service (Sigma) · unlock with TL Creds
• 🔒 RemControl Operator Panel or C2 Proxy Connection (Sigma) · unlock with TL Creds
• 🔒 BIND_VPN_SERVICE + ACCESSIBILITY_SERVICE Co-Grant Outside Play Store (SPL) · unlock with TL Creds
• 🔒 Telegram Dead-Drop C2 Resolution Chain to RemControl Proxy/Panel (SPL) · unlock with TL Creds

Indicators of compromise

As of 2026-09-27, Threadlinqs Intelligence tracks 37 indicators of compromise for TL-2026-2625.

Sample indicators (3 of 37)

• IP address: 216.126.229[.]216
• Domain: tvtap-hd[.]app
• URL: hxxps://telegram[.]me/ftestera

Defanged, TLP:CLEAR. Full set of 37 indicators: unlock with TL Creds.

Technical analysis

RemControl is an Android banking trojan first surfaced on VirusTotal on July 19, 2026, distributed via geofenced fake Google Play Store landing pages (localized in Italian, gated by User-Agent and IP geolocation to serve the malicious APK only to Italian mobile IPs) impersonating the TVTap IPTV application, plus Meta Pixel-tracked malvertising (pixel IDs 997470916598588 and 1909605966397328). Distribution domains were registered July 10, 2026, while C2 infrastructure (bnbnhura[.]top) traces back to May 12, 2026, indicating roughly two months of infrastructure staging before public samples appeared.

The dropper abuses the BIND_VPN_SERVICE permission to launch a local VPN tunnel that blocks Google Play Protect from scanning or flagging the payload, and generates a fresh Android Keystore signing key for every installation so that no two installs share a certificate hash, defeating hash-based AV/EDR detection. Strings are obfuscated with Base64 plus XOR.

Once installed, the payload abuses Android's Accessibility Service to inject full-screen phishing overlays over 30+ targeted banking apps, log all keystrokes and UI events, extract pattern-lock grid coordinates across ten OEM Android implementations, and stream the victim's live screen to the operator as WebP frames over WebSocket alongside a JSON serialization of the full accessibility UI tree. The operator can inject taps, swipes, text, and gestures directly, giving VNC-style hands-on-keyboard control of the compromised device. A self-preservation routine watches Accessibility Service navigation events (in 30+ languages) for app-management, accessibility-settings, or factory-reset screens and auto-dismisses them before the victim can act.

Command and control is resolved dynamically through Telegram dead-drop channels (telegram.me/ftestera and a private invite link), with channel content encrypted via AES-128-CBC using SHA-256 marker-derived keys, avoiding hardcoded infrastructure that would require recompilation if seized. The resolved C2 proxy (bnbnhura[.]top) is a FastAPI backend fronted by Cloudflare; the human operator panel is hosted separately at definatelynoone[.]com / 157.90.179.116.

Every analyzed sample carries a hardcoded affiliate tag, UNKK. Group-IB assesses a possible link to the Medusa Android banking botnet's UNKN affiliate program: identical dropper naming convention (instal*tvtap*.apk), shared use of Telegram dead-drop C2 resolution, overlapping Italy/France targeting, a one-character difference between the UNKK and UNKN tags, and Medusa's own distribution activity ceasing around the same period (~July 2026) RemControl appeared. Independent prior reporting on Medusa (Cleafy, PolySwarm, The Hacker News) confirms the UNKN botnet's use of Telegram/X dead-drop resolvers and Accessibility Service abuse against European banking targets, which is consistent with but does not itself confirm the RemControl link. Developer artifacts recovered from the phishing kit (Russian-language HTML comments in the overlay pages; Photoshop asset metadata showing UTC+8 authoring timezone and April 2026 creation dates) provide only circumstantial signal on operator origin and are not treated as confirmed attribution.

Confirmed phishing-overlay targeting spans more than 30 banking apps across Italy (primary, tags IT-NEW/IT-NEW4), France (primary, tags FR-NEW/FR-NEW4), Spain, Poland, Portugal (tag pt-v3), Canada, and GCC member states (tags ARABIC2/ARABIC3).

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1406 Obfuscated Files or Information; T1406.002 Software Packing; T1627 Execution Guardrails; T1627.001 Geofencing; T1629 Impair Defenses; T1629.001 Prevent Application Removal; T1629.003 Disable or Modify Tools; T1655 Masquerading; T1655.001 Match Legitimate Name or Location

Credential Access

T1417.001 Keylogging; T1417.002 GUI Input Capture

Discovery

T1418 Software Discovery

command-and-control

T1481.001 Dead Drop Resolver; T1521 Encrypted Channel; T1637 Dynamic Resolution

Collection

T1513 Screen Capture

Impact

T1516 Input Injection; T1657 Financial Theft

Exfiltration

T1646 Exfiltration Over C2 Channel

Initial Access

T1660 Phishing

Remediation

Immediate actions

• Block the confirmed distribution and C2 domains/IPs at DNS, proxy, and perimeter firewall: tvtap-hd.app, tvtap-liveapp.com, vpn.doneplay.site, ff-de.shutgpt.ir, vpn.askarzadeh.com, cdn.dlmafi.top, bnbnhura.top, definatelynoone.com, 216.126.229.216, 157.90.179.116
• Alert on any APK install requesting BIND_VPN_SERVICE and ACCESSIBILITY_SERVICE together from outside the Play Store, especially packages referencing TVTap/IPTV branding
• Warn banking customers in Italy, France, Spain, Poland, Portugal, Canada, and GCC states against sideloading IPTV/streaming apps from ad links or unofficial Play Store-styled pages

Workarounds

• Disable the 'Install unknown apps' permission for browsers and messaging apps on Android devices
• Restrict Accessibility Service grants via device policy to an allow-list of system-verified applications

Longer-term hardening

• Deploy mobile threat defense (MTD) / enterprise mobility management policy blocking installation from unknown sources and unauthorized Accessibility Service grants on managed devices
• Implement banking-app runtime overlay and screen-capture detection (RASP) to flag foreign overlay windows, unauthorized Accessibility node access, and screen-streaming behavior
• Add mobile EDR detection logic for Telegram-based dead-drop C2 resolution patterns and per-install certificate rotation as evasion signals

Affected and fixed versions

• Google — Android OS (devices permitting sideloaded/unofficial APK installs)
  Vulnerable versions: Devices with 'install from unknown sources' enabled
• Multiple financial institutions — Mobile banking applications (30+ targeted via phishing overlay, primarily Italy and France)
  Vulnerable versions: N/A - malware campaign against end-user devices, not a vendor product vulnerability

Timeline

Last updated 2026-09-27 · revalidated 1× · latest source

• 2026-04-01 Photoshop metadata embedded in phishing-overlay assets shows creation dates in April 2026 with a UTC+8 authoring timezone, indicating the phishing kit was in development at least five months before public samples appeared.
• 2026-05-12 The C2 proxy domain locked-ioc-30 is registered, marking the earliest observed RemControl operational infrastructure.
• 2026-07-01 Distribution of the Medusa/UNKN Android banking botnet, which shares dropper naming, Telegram dead-drop C2 resolution, and Italy/France targeting with RemControl, ceases around this period.
• 2026-07-10 Fake TVTap IPTV distribution domains (locked-ioc-29 and related infrastructure) are registered.
• 2026-07-19 First RemControl dropper and payload samples appear on VirusTotal, marking the earliest confirmed in-the-wild activity.
• 2026-09-23 BleepingComputer independently reports on RemControl targeting users in Europe, Canada, and the Middle East via fake TVTap IPTV apps, corroborating Group-IB's disclosure.
• 2026-09-23 Group-IB publishes technical analysis of RemControl, disclosing distribution mechanism, capabilities, IOCs, and the possible UNKK/UNKN Medusa affiliate link.

Update history

• 2026-09-27 — RemControl Android Banking Malware-as-a-Service Targets Users in Europe and Canada via Fake TVTap IPTV Apps: What changed No change to severity (HIGH), exploitability (ACTIVE), status (ACTIVE), or attribution confidence (LOW, UNKK).

Sources cited

• RemControl: Android Banking Trojan Analysis group-ib.com · Vendor report · 2026-09-23
• Cleafy unveils discovery of advanced Android Banking Trojan: Medusa cleafy.com · Vendor report · 2024-06-01
• MITRE ATT&CK Mobile - Financial Theft (T1657) MITRE · Research · 2026-01-01
• MITRE ATT&CK Mobile - Input Injection (T1516) MITRE · Research · 2026-01-01
• New Medusa Android Banking Trojan Variant Discovered blog.polyswarm.io · Blog · 2024-06-01
• New Medusa Android Trojan Targets Banking Users Across 7 Countries The Hacker News · News · 2024-06-26

More in malware

• Wpcdoor Backdoor Distributed via Korea-Based CMS DVR Management Software (Larva-26013)
• Mirax Android Banking RAT Abuses Accessibility Services for Device Takeover and Bank Fraud in the Middle East, Türkiye and Africa
• RemControl: Android banking trojan MaaS abusing Accessibility Service, AI-assisted phishing overlays (affiliate UNKK)
• Exvicy: ClickFix MaaS Framework Copycat of ErrTraffic Distributing Malware via Compromised WordPress Sites
• Blind Eagle (APT-C-36) Uses Fake Court Notices to Deliver AsyncRAT/DCRat-Lineage RAT Across Latin America

Previous and next in malware

• Macfinger ClickFix Campaign Delivers Atomic macOS Stealer (AMOS) via Fake Verification Prompts Previous report
• Autonomous AI Agent Operation (Strix, Cairn, Hermes) Steals 600K+ Payment Cards and Injects Skimmers into 100+ E-Commerce Sites Next report