Full Report
The logistics sector has become the target of a new malicious cyber campaign that distributes an Android spyware codenamed Corp MDM. According to Have I Been Squatted, the campaign uses fake Google Play pages branded as CEVA and TKW Logistics to distribute an Android Package Kit (APK) file that's dressed up as a system service. The delivered app has the package name "com.corp.mdm" Corp MDM
Analysis Summary
# Tool/Technique: Corp MDM
## Overview
Corp MDM is a compact Android spyware implant designed for targeted surveillance within the logistics sector. Disguised as a legitimate system service or mobile device management (MDM) tool, it primarily focuses on intercepting communications and redirecting calls. The malware is often distributed through typosquatted domains mimicking the Google Play Store and branded with logistics company logos (e.g., CEVA, TKW Logistics). Researchers suggest the development may have been assisted by AI, noted by specific bugs and coding patterns.
## Technical Details
- **Type:** Android Spyware / Surveillance Implant
- **Platform:** Android
- **Capabilities:** SMS exfiltration, call forwarding, persistence via foreground services, telemetry reporting.
- **First Seen:** September 2026 (Reported)
## MITRE ATT&CK Mapping
- **[TA0031 - Network Effects]**
- **[T1643 - Call Forwarding]**: Redirecting incoming calls to attacker-controlled numbers.
- **[TA0037 - Collection]**
- **[T1636.002 - SMS Messages]**: Stealing incoming SMS content.
- **[TA0027 - Persistence]**
- **[T1624.001 - System Service: Service Execution]**: Running as a hidden foreground service.
- **[TA0041 - Command and Control]**
- **[T1437.001 - Standard Application Layer Protocol: Web Protocols]**: Using HTTP for C2 communication and exfiltration.
## Functionality
### Core Capabilities
- **SMS Interception:** Captures the sender, body, and timestamp of all *new* incoming SMS messages.
- **Call Manipulation:** Can enable unconditional call forwarding (`forward_on`) to an attacker-specified number and disable it (`forward_off`) using the MMI code `##21#`.
- **C2 Communication:** Communicates with a hardcoded IP via cleartext HTTP, sending heartbeats every 30 seconds and polling for commands every second.
- **Device Registration:** Exfiltrates basic device information and assigns a unique Android ID to the infected host.
### Advanced Features
- **Stealth and Persistence:** Removes its own launcher icon upon installation to hide from the user and maintains a hidden foreground service to prevent the OS from killing the process.
- **Self-Destruct:** Includes a `self_destroy` command that disables implant components, stops services, and clears application data to hinder forensic analysis.
- **Admin Panel:** Features a password-protected web-based management panel (port 3456) for operators to manage infected devices.
## Indicators of Compromise
- **File Names:** `com.corp.mdm` (Package name)
- **Network Indicators:**
- `69.55.61[.]82` (C2 and Malware Hosting)
- `playgoogle.logisticstkwcargo[.]com` (Phishing/Distribution)
- `playgoogle.ceva-app[.]help` (Phishing/Distribution)
- Port `3456` (Admin Panel)
- **C2 Endpoints:**
- `/api/v1/devices/register`
- `/api/v1/devices/heartbeat`
- `/api/v1/devices/{ANDROID_ID}/commands`
- `/api/v1/sms/report`
## Associated Threat Actors
- **Unnamed Cluster:** Suspected Russian or Armenian nexus based on localized artifacts in the source code and UI.
- **Diesel Vortex (Related):** Possibly associated with broader campaigns targeting the freight and logistics industry.
## Detection Methods
- **Signature-based:** Detection of the package name `com.corp.mdm` and specific hardcoded C2 strings.
- **Behavioral detection:** Monitoring for apps that request `RECEIVE_SMS`, `READ_PHONE_STATE`, and `PROCESS_OUTGOING_CALLS` simultaneously while immediately hiding their launcher icon.
- **Network monitoring:** Identifying cleartext HTTP traffic to the hardcoded IP `69.55.61[.]82` or patterns of 30-second heartbeats.
## Mitigation Strategies
- **App Source Control:** Enforce policies to prevent sideloading (installing APKs from unknown sources) and disable "Install from Unknown Sources" in Android settings.
- **SMS Security:** Transition away from SMS-based MFA to App-based TOTP or hardware keys (FIDO2), as the malware specifically targets SMS for credential theft.
- **Employee Training:** Educate logistics personnel on typosquatted domains and the risk of fake "Logistics Support" apps.
## Related Tools/Techniques
- **Diesel Vortex:** A threat cluster targeting the same sector with similar goals.
- **Generic SMS Stealers:** Similar in function to older Android trojans, but modernized with MDM-themed social engineering.