Charybdis and Scylla Bound Malicious Apps

The threat actors behind a newly discovered malicious advertising app operation has become more sophisticated, expanding beyond its previous Android-specific attacks into the iOS ecosystem.

The latest campaign, included 80 Android Apps lurking in the Google Play store and, notably, 9 in the Apple App Store. All together, the malicious applications were downloaded at least 13 million times collectively.

Once downloaded, the malicious applications spoof other apps to rack up digital ad views, play hidden ads the user couldn’t see to gain fraudulent views, and even track legitimate ad clicks to hone the group’s ability to fake them more convincingly later.

The earliest version of the group was called Poseidon, then Charybdis. This latest iteration of the attack group is known as Scylla is the third wave of attacks.

Researchers worked with Google and Apple to remove the malicious applications and is continuing to work with advertising software development kit developers to mitigate the campaign’s fallout.

This is an ongoing attack, and users should consult the list of apps in the report and consider removing them from all devices.

This research was documented by the researchers from Satori Threat Intelligence Group

Indicators of Compromise

• a7fea60c806d2dd10482cd630834373e49b4d944aa19d47091b3bd0a9d7890be
• f90565a625044883ec9ce6323e813420412cf5c11e5f48f111dec4e1664cd176
• 94d10d5839343072aa41bdd61259b580e567e621818686559dffe888dd9337eb
• d43ee224e32e7d5d4ab901810afd7148cbf20ad57b07dc193cd154078ce433bb
• 0fc35fba6a708d5c6ca7da13e294cab70530c63828d9e4dbadf430e5c8f65b4b
• 0efc7c822685ebdf8f4d3d7d3104a957059c432b80624e3de6602c41bc95347f
• f0693787bffcde05fe419518621f199765ee802e00be50102c380563db678e9b
• fe1d3f3c2ed8858c0327559f66149a4f0b82b01693b296e64448dfcff9d24ae0
• 973ffa44c550c25b9ef80e176bb64f170647fd5ee115a3d03b98c88cc9a70a16
• 355a9622553ddbe7bcc78a2a04ce2f5c6067ac07e8f31168e76b884c2403923f
• 4e94ab4fddde2f3f891777d21e4859aaa68dc9366aca82e15418692afb91af36
• 438e097fa5796400141f6b88b430829c2e3eebda7531e2deec4cf81d0ca15404
• 420822558735922aee5efd5da2c22ffade14597e3f1d11ebf11ab12f0b3791b7
• 3b1210ec0bd143b3131a04ac23f7d00fa6c1639a4679f2ebd694132145ce65f2
• 6ad0de5604b1f787908fc277780b4d45dbcbfcdd98304b1f4ecf61c12e0fcc95
• 0a201d6da8e7a1b167bda949634d00d389dc995776bad398d0272c27cf85e710
• 539556f6ec50a7be633a1b5c3e30f01ba6520d6c28b1c6a57418636118e7677c
• 54c76607362e52798ae7535e8f7ead83474ecb49944e4bfc3f29537eb2e4a40c
• ca0518bb9e77c498a222fdd0d99afc4b56eaa7ed2cf7953711d2a5872cf4e689
• ec47369e7557b695784ae4b7bb419cf6d2a4978b53d94f83b3ff50b0f24138db
• 4e9fd0291f921711fb19dd21d941a324c72cb77a23a9111c631304d192cea1ca
• 2a4934fdb93b410d838f9b70f1d9a0b6a144016a5670cbf3b5df070273ff671f
• 3d67493bfd6eeadffef1d31f0eda3cb2ce11876f5a6458456322d536a0c9e7ff
• 8089bd929512552664daf8f28bee643bb88fbf3ceadc60d0faa439072473f804
• 27d7f05cc02bcfe7b1d5e746c5025b7bffe2534086ca4f0c04336c2d12891283
• 4d1ccfa348c6c20b0291ac3ec2dacca47ed89b14f9d4b8ccde683f368494dc9f
• b6399d21f7a72f1b0bbc73864c9c228c5a4b8f6331aa5133d56589439f9747e7
• d6fc218b1ca0eff4e2ee65dcd2a2b173192d9c0617de5134a150bbf6972e195c
• 0695f9028b1a6038ece961b494971f6762b403952c37b7f95e66112d8fc8027b
• 1cea4435ead7d166e509f3cc9c9a556383822ca98ee3fdfd48c4c9d683f833d3
• 21c77771d23805593ff3f637245992376d7dce6fc18de4862973b94c184aa91c
• abb3ae69fe1f6cf35b54508025c8a6734fe35ded22a6d42bcbcc65aa75bddb3b
• 08aeda329f3e0807625f228db30001ef83ff48fa82962bc50f84f8904a20dafb
• d51080d79668b6d4036a7e5ece86389f7f12305b8ca2c379559b764455406180
• 8d5f8dd171fff8dd838871a519ae243c5bb4beeaf904cd365b97a05506aefb8a
• 7bc9e4ebf7ea018d87ac1fb47bdebe3dcf94dd02d0d8fefef902c22166d33493
• 53739fa52192f8493da4a0067ec27c753a017941325f913508a8c8c840b534d9
• 4cb13dbb442a0b2c657e5c79a60e856f86e18ee425896b996b9a6452519aca2c
• ee99a02f917a083348984b29bbfec81ec545bc16d401b391c923db14d546e353
• 69aff645ee74bb7fa0ec4c142a7c5b07fda768742051a05d41ecb5ac456d5d28
• 1a23244555d1dbd9ead7019ed07dc6af157e0321e24182c53329be5d734a49ca
• 18ad35cadd4a4a15a40a85ef577645b0ff70199b11b25732e94b403f0063bf23
• e8d7baecb47b3a671c99cb0be21cb6b9e3ca4513cff6f02e51ac9d417d88b73b
• 90857e546fc916b77b1c307ad5a8c19ab213bdadd201350d4c7e6a418bde489f
• 62272f387631a5dc4b5561ad892170f94cb1ebf804a0c863929dae76084e9529
• f0d976fd5061ca5e5a8982a7f7cfafe472f6570a7de7f752501260599034c744
• c5c51f40f5bf4e63795cffd5d2e21ee64c1a586c00249a84ad315b2c7ea30acc
• c3db0ee64786b4aec5d61c3a993ab25fab2c04d2691ddfe4aae2e0fc87d4952f
• c4a7057b987ce0daf8e355e801b2ab9386a72eaa80d3592dadfd4c55e5997304
• 2b109f567bcd83ab6548add5bbad392f0e5b4e7d3eeedd1363c46bdcc95d8ed3
• b9c94a1c06e671600fd4d9dbfc2a7852a3786d10394afbfb477f1b6df7c74952
• 1a667ba74f9ec4b0d1d36408d8af1ff2493156960134178ff84f4a4d36837c15
• 2ce1c4dc30313facbdec12030cbd3a94dbc66dbfd2feab7bb231a3bb847b7a86
• ccecf8310b7d300abe7ff808df4198ed4d0c9e734aaf8c95413d6a67abc4290c
• 33472b314c5beb8a0927522e9adf74e38b92ec5638f10d58457072177b926fb1
• 97ed09697b85cf1d58aebc4d8f306c19beff1b949b80682c414f33d902521778
• 6687bdee0ecfec779f660327832d17739d95a4dd06536bbb387bd1175d5eb65c
• 2f949069c0951b7d8203d17d401e0ad5b42e7bb3c0b8c56b4ac5383c3a21c336
• 6c00ad91e11ded8b006372d95ab40f0d0769a2fbaaf21909b42bfad147fe74df
• f7f55f024a5c3e5b18cde924ce25f72aab4523a148c24f0d9eea5d2581caa470
• 028dfbf91b3b54425ddb6445e2ec3ed01e1f5f736c6821447b67816148a3f6fe
• d45b38198005b9de44994347e9d40ad822abaa969c3a53ec63cc31adcfb9772d
• 67971ff706a897fdca3487bc5782a3813a3d3d2b4261524cc214f1f5b6ffdf27
• 572cc347cbcdbcf0f09470d22215f6791512ca0e74434e357c967e7515d9c2f8
• fe8761e1be482bcea96d0edad74af19c6ce6ad85fe88178ff8343f0df61a1ccc
• e0c1774a83eda1420d5798a231592afdb8844ae7c0a2614142290d384327df63
• 5773e83f37ba16600f3e71bc5956d56be3a6c013e95f1c216bbf41eb8acf9be5
• 0f1216681cca2781e73b50fbeb96bbe55a483aef79f2f5109e5776067a645fa4
• 96c35c5887b4a11a11590e9bba39771098ad83946eb0387cc52391b808191aaa
• 3c82a1c3fa04bbd4cb8b77f1ee5fe905b4a94d2e63f80a5ae19ecd71e9d0e920
• b18072fb8f54e020e028cdd10fb5304ab55328c90c599fc2528d3e2b2713ccf8
• e16dbfa2f712f8ccf36c07c5015142e0d63db0aec12d6efe656ce83ae285b8da
• a65f2902fd3c067432804fd03b2c24de85af88a1f22596a1a3da65eb26cb716d
• d40968b523ee99a78d752711e677bafa5a872f17d963640a4fac9418cca50ceb
• 577f0644f9cd0849e51a6f5c0dadd7bafcc11b29b6353d97ffa039f3835747a6
• ec41dce767a5f49bbe1191f127f2f2c5a6a6345650b51a53795e273504062674
• 17aa73a2c3967efd6b11b8c59cf51fcab839169b2281c7f435b2cca5e8ab1ab5
• 576e5381142a2fe7fa8279d2a8d7fd4123adb7ae885029dca1bc5050ada2da0b
• 6d6a8f797415a26f51e1a5ba1de7c75cddd3b5a5a5c5148590355bf62f84b0be
• f9932711ca68d431824fa1557a333176e97faf529b1edde6bd7c0e8e2b614114