The commodification of malware has long been a concern for security teams. A recent discovery by Zimperium's zLabs reveals another iteration of this trend: RedWing, an Android banking malware operation distributed and rented via Telegram as a turnkey fraud service. The operation represents a shift towards lower barriers to entry for cybercriminals—you no longer need technical skill to compromise mobile banking accounts.
The Malware-as-a-Service Model
RedWing operates on a rental basis, similar to earlier variants like Oblivion, which charged around $300 per month for access. Rather than requiring buyers to develop their own malware, customise it, or manage infrastructure, the service provides a complete package: the malicious Android application, command-and-control connectivity, and often a dashboard to manage compromised devices. This model dramatically lowers the technical bar for entry.
The use of Telegram as the distribution and operational channel is significant. Telegram's end-to-end encrypted channels and relative anonymity make it an ideal platform for coordinating criminal services. Operators can host sales channels, customer support, and even technical discussions about new variants—all within an environment that resists traditional law enforcement monitoring.
Once installed on a victim's device, the malware performs several core functions: it extracts banking credentials, captures one-time authentication codes (typically sent via SMS or generated by authenticator apps), and allows the operator to take control of the device remotely. This combination defeats most standard two-factor authentication schemes, since the attacker controls both the login credentials and the second factor.
Infrastructure and Operational Resilience
What makes malware-as-a-service operations difficult to disrupt is their distributed infrastructure. Command-and-control servers are typically hosted across multiple jurisdictions, often in regions with weak cybercrime enforcement or favourable legal conditions. The operators rent or compromise servers to host C2 infrastructure, then rotate endpoints regularly to evade blocklisting.
Payment processing for these services often relies on cryptocurrency or other mechanisms that avoid traditional banking oversight. According to Zimperium's research, customer acquisition and support occur entirely within private Telegram channels, creating a closed-loop distribution model that avoids public exposure.
The operational cost structure is lean. Developers maintain a single codebase and infrastructure, then lease access to multiple customers—each of whom focuses on their own victim acquisition and fraud execution. This separation of concerns means the malware vendor never directly interacts with victims, reducing their legal exposure.
Detection and Attribution Challenges
Detecting RedWing requires understanding both its infection vectors and its command-and-control behaviour. The malware is typically distributed through malicious app stores, phishing links, or trojanised versions of legitimate applications. Once installed, it runs with the permissions granted at install time, allowing it to intercept SMS messages and overlay the legitimate banking app with a fake login screen.
Attribution of these operations is complicated by the renting model. Multiple threat actors use the same malware, making it difficult to distinguish between variants, versions, and operational groups. Zimperium's identification of RedWing as a variant of Oblivion suggests a lineage, but malware families can diverge significantly as different operators modify and customise the code for their own purposes.
For organisations defending against these threats, several layers of protection matter: device-level threat detection that can identify suspicious permissions or behaviour; anomaly detection on banking transactions themselves; and user awareness training to reduce initial compromise rates. However, the low cost of entry for attackers means the volume of attempts will likely remain high.
The Broader Picture
RedWing exemplifies a troubling trend: as cybercrime becomes increasingly professionalised and organised, it adopts service-oriented models similar to legitimate software distribution. The vendors handle technical complexity; the buyers handle victim targeting. This division of labour scales fraud operations and makes enforcement more difficult, since shutting down a single operation doesn't eliminate the underlying malware.
Banking institutions, payment processors, and device manufacturers continue to strengthen defences—sandboxing suspicious apps, requiring explicit user consent for sensitive permissions, and implementing fraud detection on transaction patterns. Yet the fundamental tension remains: any system that allows legitimate users to authenticate must also be vulnerable to attackers who compromise that authentication path. Until mobile devices themselves become more resistant to application-level malware, services like RedWing will continue to find customers willing to rent them.
