Android Banking Trojan, Python Supply Chain Attack, and UEFI Bootkit

Mauven examines three active threats with direct implications for UK small businesses. First, the RemControl Android banking trojan is spreading through malvertising, targeting over thirty financial institutions across Western Europe by exploiting accessibility services to steal credentials and two-factor codes in real time. Second, a supply chain compromise in LiteLLM version 1.107.0, a widely used Python library for AI development, contains malicious code designed to steal API keys and credentials before application code even executes. Third, the BlackX UEFI bootkit, attributed to Chinese state-sponsored group APT41, bypasses Secure Boot protections and survives operating system reinstalls by operating at firmware level. The episode closes with a timely warning about year-end phishing campaigns that exploit the legitimate administrative activity typical of Q4. Throughout, Mauven identifies the operational gaps between what IT estates are supposed to protect and what they actually cover, with practical guidance on BYOD policies, supply chain verification, and firmware patching.

Chapters

• Introduction Mauven introduces three threat items with direct relevance to UK small businesses, emphasising the urgency of addressing BYOD Android banking risks and the approaching year-end phishing season.
• RemControl Android Banking Trojan Analysis of the RemControl malware-as-a-service operation targeting Western European financial institutions through fake TVTap downloads, exploiting Android accessibility services to steal credentials and intercept two-factor authentication codes via live screen streaming.
• Call to Action Reminder to follow the show and share briefings with colleagues who need threat intelligence.
• LiteLLM Supply Chain Compromise Examination of malicious code discovered in LiteLLM version 1.107.0, a Python library for AI development, which uses startup hooks to steal credentials and load remote payloads, with implications for organisations and their suppliers.
• BlackX UEFI Bootkit Nation-state UEFI bootkit attributed to APT41 that bypasses Secure Boot using the Baton Drop vulnerability, persists through OS reinstalls, and disables Kaspersky and Avast security tools at firmware level.
• Year-End Phishing Season Warning about the seasonal increase in phishing campaigns exploiting legitimate Q4 administrative communications, with guidance on verification procedures.
• Closing Mauven summarises the common thread of operational gaps between intended and actual IT coverage, urging listeners to identify and address these vulnerabilities.

Links

• https://www.group-ib.com/blog/remcontrol-android-banking-trojan/
• https://www.microsoft.com/en-us/security/blog/2024/10/23/litellm-supply-chain-compromise/
• https://www.bleepingcomputer.com/news/security/blackx-uefi-bootkit-used-in-espionage-campaign/
• https://www.ncsc.gov.uk/collection/supply-chain-security
• https://www.netcraft.com/blog/year-end-phishing-campaigns/