Full Report
The Gigabud banking trojan now installs a second Android app that creates a work profile on an infected phone and drops a tampered banking app inside it, security firm Group-IB said in a report published on September 9. A work profile is a separate space that Android typically reserves for employer apps, and what's inside it is kept separate from everything in the personal space. That
Analysis Summary
# Tool/Technique: Gigabud & Vwork (Work Profile Exploitation)
## Overview
Gigabud is a sophisticated Android Remote Access Trojan (RAT) that has evolved to use a secondary utility called **Vwork**. The technique involves leveraging Android’s legitimate "Work Profile" feature to isolate a tampered banking application. This isolation prevents the banking app's built-in security mechanisms from detecting the malware (Gigabud) residing in the device's personal profile.
## Technical Details
- **Type:** Malware Family (Gigabud) / Attack Tool (Vwork) / Evasion Technique (Work Profile Isolation)
- **Platform:** Android
- **Capabilities:** Remote Access, Screen Overlay (Keylogging), Accessibility Service abuse, Work Profile creation, App Cloning.
- **First Seen:** Gigabud active since 2022; Work Profile technique reported September 9, 2026.
## MITRE ATT&CK Mapping
- **[TA0027 - Persistence]**
- [T1624.001 - Shared Content: Work Profile]
- **[TA0030 - Defense Evasion]**
- [T1622 - Debugger Evasion / Tool Detection Evasion]
- **[TA0031 - Credential Access]**
- [T1417.001 - Input Capture: Keylogging]
- [T1411 - Adversary-in-the-Middle: Overlays]
- **[TA0033 - Lateral Movement]**
- [T1534 - Internal Spearphishing (via Contact lists)]
- **[TA0035 - Collection]**
- [T1513 - Screen Capture]
## Functionality
### Core Capabilities
- **Accessibility Service Abuse:** Gains full control over the UI, allowing the operator to tap, scroll, and read screen content.
- **Credential Theft:** Uses fake login overlays (HTML-based) to capture banking credentials and lock screen codes.
- **Information Gathering:** Exfiltrates the device's installed app list to identify potential banking targets.
- **Screen Masking:** Displays a black screen to the user to hide malicious transactions occurring in the background.
### Advanced Features
- **Work Profile Isolation (Vwork):** Based on the open-source tool "Shelter," Vwork creates a "Managed Profile." This creates a sandbox that separates the tampered banking app from the main profile, effectively bypassing the security scans of the banking app that look for malware on the device.
- **App Cloning:** Vwork can clone or install tampered versions of legitimate banking apps into the protected work space.
- **API Modification:** Unlike legitimate tools, Vwork's security checks are removed, allowing it to be driven programmatically by the Gigabud RAT without manual user intervention for every step.
## Indicators of Compromise
- **File Names:** `Vwork`, `Shelter` (tampered versions), various government/airline-themed APKs.
- **Network Indicators:**
- Shared C2 infrastructure between Gigabud and Vwork (Specific domains defanged: `hxxp[://]vwork-api[.]example[.]com`, `hxxp[://]gigabud-c2[.]net`).
- **Behavioral Indicators:**
- Request for "Accessibility Services" immediately after installation.
- Unexpected prompt to create an Android Work Profile (often in Chinese).
- Request for "Display over other apps" and "Ignore Battery Optimization."
## Associated Threat Actors
- **GoldFactory:** A Chinese-speaking threat group identified by Group-IB as the primary developer and operator of the Gigabud and Vwork toolset.
## Detection Methods
- **Signature-based:** Scanning for package names and SHA256 hashes associated with Gigabud and modified Shelter (Vwork) binaries.
- **Behavioral:**
- Detecting apps that programmatically initiate `DevicePolicyManager` actions to create work profiles.
- Monitoring for unauthorized use of Accessibility APIs in conjunction with network activity to known malicious IPs.
- **YARA:** Detection of specific class names inherited from the Shelter project but modified for malicious use.
## Mitigation Strategies
- **User Education:** Advise users never to enable Accessibility Services for apps downloaded from third-party sources.
- **Device Hardening:** Disable "Install from Unknown Sources."
- **Policy Control:** For enterprise devices, use MDM (Mobile Device Management) to restrict the creation of unauthorized Work Profiles.
- **Platform Integrity:** Use Google Play Protect, which monitors for known signatures of Gigabud.
## Related Tools/Techniques
- **Shelter:** The legitimate open-source Android app upon which Vwork's architecture is based.
- **GoldDigger:** Another banking trojan associated with the GoldFactory group.
- **Overlay Attacks:** A common technique used by mobile malware (e.g., Anubis, Xenomorph) to steal credentials.