New TrickMo Variant Uses TON C2 and SOCKS5 to Create Android Network Pivots

A new TrickMo Android banking trojan variant uses The Open Network (TON) blockchain for command-and-control communications and network pivoting capabilities.

• •Uses embedded TON proxy for stealthy C2 instead of traditional DNS infrastructure
• •Adds network pivot and traffic-exit node functionality through SSH tunnelling and SOCKS5 proxying
• •Supports network reconnaissance commands including curl, dnslookup, ping, telnet, and traceroute
• •Distributed via dropper apps masquerading as TikTok or Google Play Services
• •Targets banking and cryptocurrency wallet users in France, Italy, and Austria

This summary was automatically generated by AI based on the original article and may not be fully accurate.