⚠️ THREAT ALERT: New TrickMo Variant Uses TON C2 and SOCKS5 to Create Android Network Pivots
The latest TrickMo variant leverages a novel command‑and‑control (C2) architecture that utilizes Telegram Open Network (TON) as a covert transport layer, effectively bypassing traditional DNS‑based detection. The malware embeds a lightweight TON client within the Android payload, establishing encrypted tunnels over TON’s decentralized node network. Once the initial beacon is received, the malicious code spawns a local SOCKS5 proxy bound to 127.0.0.1:1080, allowing any downstream application on the infected device to route traffic through the TON tunnel. This pivot capability enables threat actors to chain compromised Android hosts as relay points for lateral movement across corporate networks, effectively turning mobile devices into “mobile botnet” edge nodes that can exfiltrate data or proxy attacks without exposing the operator’s IP address. The use of the TON protocol circumvents typical network ACLs and IDS signatures because traffic appears as legitimate peer‑to‑peer communication on port 443 or 80, often masquerading as standard Telegram traffic.
Preliminary binary analysis has identified the incorporation of several known third‑party libraries with unresolved vulnerabilities. The embedded TON client utilizes libton‑crypto version 0.2.3, which is vulnerable to CVE‑2023‑42631 (integer overflow in the key derivation routine) and CVE‑2023‑42632 (remote code execution via crafted TON messages). Additionally, the SOCKS5 implementation reuses an older version of the AndroidX Netty‑socket library that is affected by CVE‑2022‑30190, permitting privilege escalation through crafted authentication packets. The malicious installer also bundles an outdated version of the open‑source “Objection” framework (CVE‑2022‑22965) that can be abused to bypass SELinux policies on rooted devices. The combination of these CVEs provides a chain that allows the initial payload to gain root, install the TON client, and establish persistent SOCKS5 proxy services without user interaction after the initial phishing or repackaged app install.
Mitigation should focus on a multi‑layered approach: first, enforce strict application whitelisting and block the installation of unsigned APKs, especially those requesting high‑risk permissions such as “modify network settings” and “run as background service.” Network defenses must be hardened by deploying deep‑packet inspection (DPI) capable of identifying TON protocol fingerprints—even when encapsulated in TLS—and by enforcing egress filtering that restricts direct outbound connections to known TON relay endpoints. On the host level, organizations should patch the vulnerable libraries referenced above (upgrade libton‑crypto to ≥0.3.0, Netty‑socket to ≥4.1.85, and remediate the Objection framework) and employ mobile threat defense (MTD) solutions that monitor for anomalous SOCKS5 proxy creation and unexpected high‑entropy traffic patterns. Finally, continuous threat‑intel monitoring for new TrickMo signatures and rapid application of Android security patches will reduce the attack surface and limit the effectiveness of this TON‑based pivot technique.
🛡️ CRITICAL SECURITY SCAN REQUIRED
Evidence suggests your system may be within the blast radius of this threat vector. Use the ZeroDay Radar scanner to verify your integrity immediately.
>> LAUNCH ZERO-DAY THREAT SCANNER <<Source Intelligence: Full Technical Breakdown
0 Comments