Threat video1:00
Gigabud Vwork Shelter Fork App Cloning: Detection & IOCs
Gigabud clones banking apps inside a Vwork work profile, then runs fraudulent transactions: 9 detection rules, 15 IOCs and a free Splunk SPL rule.
Read the full threat intel for Gigabud Vwork Shelter Fork App Cloning: Detection & IOCs →
Chapters
- 0:00The hookVwork cloned apps on about 1,469 devices.
- 0:06The storyThe cloned app ran isolated, saw no other apps.
- 0:12Attack pathFake apps installed Gigabud and Vwork.
- 0:26AttributionAttributed to GoldFactory.
- 0:31Indicators of compromise10 indicators to hunt: 9 SHA-256 hashes and 1 package name.
- 0:38MITRE ATT&CK techniques12 ATT&CK techniques, from initial access to command and control.
- 0:43Remediation3 steps now: Hunt for and block the published Gigabud, Vwork and tampered.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Vwork cloned apps on about 1,469 devices.
0:06The cloned app ran isolated, saw no other apps.
0:09Fraud went undetected.
0:12Fake apps installed Gigabud and Vwork.
0:14Vwork created a work profile and cloned the banking app.
0:18The cloned app ran isolated from other apps.
0:21The operator executed fraudulent transactions.
0:27Attributed to GoldFactory. Confidence: medium.
0:3110 indicators to hunt: 9 SHA-256 hashes and 1 package name.
0:3912 ATT&CK techniques, from initial access to command and control.
0:443 steps now: Hunt for and block the published Gigabud, Vwork and tampered.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.