Full Report
A new NFC relay malware designated as WindRelay, paired with SpyNote RAT enables live-call fraud, combining social engineering with dual digital and physical cash-out.
Analysis Summary
# Tool/Technique: WindRelay & SpyNote RAT (NFC Relay Attack)
## Overview
WindRelay is a specialized Android malware designed to perform NFC (Near Field Communication) relay attacks. It works in tandem with the SpyNote RAT (Remote Access Trojan) to facilitate complex financial fraud. By relaying NFC signals from a victim’s device to a threat actor’s physical device, attackers can perform unauthorized contactless payments or ATM withdrawals in real-time while using SpyNote to manage social engineering and live-call fraud.
## Technical Details
- **Type:** Malware Family (NFC Relay & RAT)
- **Platform:** Android
- **Capabilities:** NFC signal relaying, remote device control, live audio/video streaming, SMS interception, and overlay attacks.
- **First Seen:** Approximately mid-2024 (based on recent campaign reporting).
## MITRE ATT&CK Mapping
- **[TA0030 - Influence]**
- **[T1273 - Manipulation of Device Hardware]** (Relaying NFC radio signals)
- **[TA0037 - Command and Control]**
- **[T1071.001 - Application Layer Protocol: Web Protocols]** (C2 communication via HTTP/WebSockets)
- **[TA0033 - Effects]**
- **[T1456 - Financial Theft]** (NFC-based cash-out)
- **[TA0006 - Credential Access]**
- **[T1417 - Input Capture]** (Keylogging and screen recording)
- **[T1516 - Adversary-in-the-Middle]** (Relaying NFC data between terminal and card)
## Functionality
### Core Capabilities
- **NFC Relaying:** Captures NFC data packets from the victim's phone (which acts as a "proxy" for their credit card or digital wallet) and transmits them to a server.
- **Remote Access (SpyNote):** Provides full control over the infected device, including file management and application manipulation.
- **SMS Interception:** Steals One-Time Passwords (OTPs) used for transaction verification.
- **Social Engineering Support:** Enables live-call fraud where attackers can monitor or participate in calls to manipulate the victim.
### Advanced Features
- **Physical Cash-Out:** Allows a physical operative located at an ATM or Point-of-Sale (POS) terminal to use their own phone to "mimic" the victim's NFC chip, enabling physical withdrawals.
- **Dual-Malware Synergy:** WindRelay focuses on the hardware communication (NFC), while SpyNote handles the software environment and human element (social engineering).
## Indicators of Compromise
### File Hashes (SHA1)
**WindRelay Variants:**
- `a1574476a616599a202cc731a6d5dbf9b3a635f0`
- `48d011117eacf57128c7e473bb5d4d69e3d41ef6`
- `ec730da64f9feae4259ebc88113c5cebdf2b1ad7`
- `8e665c12b7d8e80c72d86ed4425663ecd74e453c`
- `67e2a1e8ab963086bb768b28307cf58dadb0acc7`
**SpyNote RAT Variants:**
- `e05575afe5a01d150daa8b4bb935213cc0e538f6`
- `193078cda795dc2f12983e9b66821f7e67c6495d`
- `38ca1bc31ccdc1c650720abd76bcc619532c0166`
- `22fa5c967b0775c3f3398dcf5dbb46ff80e1708b`
### Behavioral Indicators
- Requesting `BIND_ACCESSIBILITY_SERVICE` permissions to automate interactions.
- Requesting `NFC` and `NFC_TRANSACTION_EVENT` permissions.
- Maintaining active WebSocket connections to non-standard remote ports for data relay.
## Associated Threat Actors
- Currently attributed to sophisticated cybercriminal groups specializing in Android-based banking fraud (specific group names often vary by vendor, but the TTPs align with evolved "Neo-Banking" fraudsters).
## Detection Methods
- **Signature-based:** Scanning for the SHA1 hashes listed above within mobile security suites.
- **Behavioral:** Monitoring for applications that request Accessibility Services and NFC permissions simultaneously, especially those sideloaded via APK.
- **Network:** Monitoring for persistent connections to known C2 domains (e.g., [.]top or [.]xyz domains used for relay servers).
## Mitigation Strategies
- **Disable NFC:** Keep NFC turned off when not in use.
- **Avoid Sideloading:** Do not install applications from untrusted third-party sources or links sent via SMS/WhatsApp.
- **Permission Scrutiny:** Deny "Accessibility Service" requests to apps that do not clearly require them for a legitimate purpose.
- **Bank Alerts:** Enable transaction limits and real-time alerts for all contactless payments.
## Related Tools/Techniques
- **NGate:** A similar Android malware family that also utilizes NFC relaying.
- **Overlay Attacks:** Technique used by SpyNote to steal credentials by drawing fake windows over legitimate banking apps.
- **Call Redirection:** Used in social engineering to intercept bank verification calls.