July 6, 2016

A Spike in Shedun, Also Known as HummingBad

Person holding phone with skulls and cross-bone on display.
Platform(s) Affected
Android
Threat Type
Malware
Entry Type
Threat Summary
Platform(s) Affected
Android
Malware
Threat Summary

There is a particularly dangerous family of malware, known as Shedun, which Lookout discovered and first reported last November. Shedun is trojanized adware that roots Android devices, masquerading as legitimate apps such as Facebook, Twitter, WhatsApp and Okta’s enterprise single sign-on app. Three similar families are associated with Shedun: Shuanet, ShiftyBug, and one we later discovered, BrainTest.To make matters more confusing, different vendors have different names for Shedun. You may have heard Shedun called HummingBad, Hummer, or ANDROIDOS_LIBSKIN, or right_core (the APK name). Recent reports on HummingBad raise alarms of a malicious and widespread family one of our competitors claims to have first discovered in February 2016. This is the same as Shedun, which we discovered several months before then, in November 2015. This family is extremely malicious, but it is not new.

What is new

We have observed a recent spike in Shedun detections on Lookout’s mobile threat network. We believe this is attributable to the authors building new functionality or distributing the malware in new ways.

Shedun detections spiked over 300% in March, and further spiked over 600% in the past month.

Shedun detections spiked over 300% in March, and further spiked over 600% in the past month.

Shedun and the related families follow a particular pattern — they are adware that silently roots devices, allowing them to remain persistent even if the user performs a factory reset. Shedun also uses its root privileges to install additional apps onto the device, further increasing ad revenue for the authors and defeating uninstall attempts.

Lookout customers are protected from Shedun, also known as HummingBad and Hummer, as they have been since we discovered it last Fall.

Colleagues standing in an open meeting area and sharing a humorous moment

Stop Cyberattacks Before They Start With Industry-Leading Threat Intelligence.

Other Related Threats

New

September 19, 2023

CVE-2023-4863

Google released a patch for a new zero-day vulnerability in Chrome tracked as CVE-2023-4863, which CISA also listed in their database.

September 18, 2023

ASPL 2023-09-01 / CVE-2023-35674

September 20, 2023

Deblind Analyzed: Lookout Identifies and Dissects Android App Used by Russian Sandworm APT's Infamous Chisel Spyware Tooling