Android Device Malware Attack
Malware infection detected in Gigaset Android devices as external update server got compromised.
Gigaset is a German manufacturer of telecommunications devices, including a series of smartphones running the Android operating system.
Earlier Gigaset users suddenly found their Gigaset mobile devices repeatedly opening web browsers and displaying advertisements for mobile game sites.
In addition, during inspection found an unknown application called ‘easenf ‘ running, that when deleted, would automatically be reinstalled.
Based on their research, Malwarebytes states that the ‘Android/PUP.Riskware.Autoins.Redstone‘ app will download further malware on devices that are detected as ‘Android/Trojan.Downloader.Agent.WAGD.’
However, the list of malware apps installed on the devices include —
Unless Gigaset mobile devices, below are the list of other manufacturers targeted by malware
- Gigaset GS270; Android OS 8.1.0
- Gigaset GS160; Android OS 8.1.0
- GS170: all software versions
- GS180: all software versions
- Siemens GS270; Android OS 8.1.0
- Siemens GS160; Android OS 8.1.0
- Alps P40pro; Android OS 9.0
- Alps S20pro+; Android OS 10.0
Gigaset started investigating the incident intensely by working closely with IT forensic experts and the responsible authorities.
In the meantime researchers were able to identify a solution to the problem, also contacted the update service provider.
Importantly, potentially affected older older smartphone models of the GS100, GS160, GS170, GS180, GS270 (plus) and GS370 (plus) series.
In order to happen this the devices must be connected to the internet (WLAN, WiFi or mobile data).
Also, it is recommend connecting the devices to their chargers. Affected devices should automatically be freed from the malware within 8 hours.
On the other hand, user are can check and clean their devices manually:
Check the current software version under “Settings” -> “About the phone” -> at the bottom under “Build number“.
Also, uninstall the malware if the above mentioned list of apps are found in your device:
Open Settings -> Apps & Notification -> App Info -> Desired App(mentioned above) -> Uninstall
If the apps are still present, please contact Gigaset Service on +49 (0)2871 912 912 (At your provider’s landline rate)
Indicators of Compromise