- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- China(high confidence)
- Motivation
- Financial crime
- Seen
- 2013
- Sources
- 7 sources carry it
- Identifier
- GINC-APT-0263 · yanbian-gang
ChinaWhat it is
RiskIQ characterizes the Yanbian Gang as a group that targeted South Korean Android mobile banking customers since 2013 with malicious Android apps purporting to be from major banks, namely Shinhan Savings Bank, Saemaul Geumgo, Shinhan Finance, KB Kookmin Bank, and NH Savings Bank.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Other names
- Yanbian
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- Japan, South Korea
Tools
The tools and malware families the sources tie to it.
- Androrat
- DroidJack
- FunkyBot
- MobileOrder
- Moqhao
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de