RedWing is a new Android spyware variant distributed as Malware-as-a-Service via Telegram channels and mobile phishing sites, with links to Russian threat actors. Its payloads and droppers currently evade many conventional security tools, and it appears to be a new variant of the Oblivion malware based on similarities in the dropper stage and overlays.
Executive Summary The zLabs team has uncovered RedWing , a new Android spyware variant offered as a Malware-as-a-Service (MaaS) through a Telegram channel and appears to have links to Russian threat actors. Malicious operators distribute this rental-based malware through mobile-targeted phishing sites. A substantial number of the associated payloads and droppers currently evade detection by conventional security tools. This discovery looks like a new variant of the oblivion malware, due to the similarity on the dropper stage and some of the overlays used.