Inside Corp Mdm Android Spyware Targeting Logisitics

A malware campaign targeting the logistics sector used fake Google Play pages branded as CEVA and TKW Logistics to distribute an Android Package Kit (APK) file disguised as a system service. The delivered app, package com.corp.mdm , is a compact surveillance implant designed to exfiltrate newly received SMS content, divert calls, and maintain a hidden foreground service.

The implant is narrow by design. It does not contain the broad surveillance functions often associated with commercial Android spyware. We assess that the threat actor likely used AI during development, and the spyware contains bugs that hinder its capabilities.

The observed Android spyware was a subset of a wider campaign that we assess with high confidence primarily targeted the logistics sector. The broader campaign included credential phishing and Windows-based malware, with indicators suggesting Armenian and Russian links.

Have I Been Squatted has previously reported on Diesel Vortex , a Russian and Armenian cybercrime group that used phishing to facilitate cargo theft. There is no evidence that the two groups are the same, although both strategically target the logistics sector to collect information that can facilitate cargo theft.

From fake Play listing to hidden service #

The delivery pages reproduced the visual and information architecture of Google Play while operating from non-Google domains. They copied Play , ratings, reviews, data-safety cards, support details, compatibility text, and install controls. Both listings then instructed visitors to open the downloaded APK and permit installation from unknown sources.

The domains hosted the malicious APK packages on playgoogle.logisticstkwcargo[.]com and playgoogle.ceva-app[.]help , which both resolved to the same virtual private server (VPS) IP address, 69.55.61[.]82 . Both sites were tailored to the corresponding logistics firm, although they hosted the same APK.

This same IP address is hardcoded by the implant for command and control (C2). The operator panel was served from that address on Transmission Control Protocol (TCP) port 3456 and exposed its own route for downloading the same APK.

The C2 IP address 69[.]55[.]61[.]82 was also used to host credential-phishing lures and additional Windows malware targeting the logistics sector. We assess that this broader activity collected information to facilitate cargo theft. The wider campaign may be explored in future research.

The recovered chain begins in the browser, crosses into Android through a sideloaded package, and then splits into collection, call-forwarding, and cleanup behavior.

All observed APKs were identical, regardless of their delivery method.

The APK is signed with a self-issued certificate whose subject and issuer are both CN=Corp MDM,OU=Mobile,O=Corp,L=Unknown,ST=Unknown,C=US . Its validity begins on June 3, 2026, and extends to 2053. Its SHA-256 fingerprint is 29f0f6c51fda728b91aaa299cf14758f01d7d83e941a549e26b8fbf2eb70fc42 .

Only seven top-level app-specific classes contain substantive logic: MainActivity , MdmService , MdmApp , BootReceiver , SmsReceiver , CallForwardManager , and ApiClient .

Permission capture behind a fake setup #

MainActivity removes the title bar, forces a full-screen display, and presents a progress sequence framed as system configuration. It cycles through ten messages, including Initializing system... , Connecting to server... , Synchronizing data... , Applying settings... , and Starting services... .

Half a second after launch, the activity asks for RECEIVE_SMS , READ_SMS , and CALL_PHONE . Android 13 and later also receive a POST_NOTIFICATIONS request. The loader continues for roughly ten seconds, giving the interaction the appearance of a routine device setup rather than a permission grab.

Hidden, persistent, but not privileged #

When the progress sequence finishes, MainActivity starts MdmService , disables its own component, and exits. Pressing Back triggers the same routine immediately. Because MainActivity is the only launcher entry and the manifest excludes it from Recents, the app disappears from ordinary launcher and task-switcher views while remaining installed.

The foreground service uses a low-importance notification channel named System Service . Its ongoing notification is titled Android System and reads System service running . These strings provide plausible system cover while satisfying Android's foreground-service requirement.

Persistence relies on three conventional mechanisms:

MdmService returns START_STICKY , allowing Android to recreate it after process loss.

BootReceiver starts registration and the service after normal boot or vendor quick boot.

The same receiver restarts the implant after package replacement.

SmsReceiver handles the protected SMS_RECEIVED broadcast. For each SMS protocol data unit (PDU), it extracts the sender, message body, and received timestamp, attaches the Android identifier, and posts the data to /api/v1/sms/report .

The receiver has no disk queue and no retry mechanism. If the request fails, the app logs the error and discards the report. Multipart messages are not reconstructed before transmission, so individual segments can arrive as separate records.

The distinction between RECEIVE_SMS and READ_SMS is important. Although the app requests both permissions, the recovered code never queries the inbox. The operator command named sync_sms only returns Sync initiated ; it does not read or upload historical messages. The threat is interception of new inbound messages after permission grant, not retrospective extraction of the existing inbox.

That limited collection path is sufficient to expose high-value content. SMS remains common for one-time passcodes, password resets, account recovery, transaction notifications, and dispatch or delivery updates. The sender, full body, and timestamp all leave the device over cleartext HTTP.

The operator can send forward_on with a destination number. CallForwardManager strips all characters except digits and a leading plus sign, builds **21* # , and submits it through TelephonyManager.sendUssdRequest . This invokes an Unstructured Supplementary Service Data (USSD) or Man-Machine Interface (MMI) forwarding sequence, depending on the carrier implementation. The forward_off command submits ##21# .

The implant stores forward_active and forward_number in local preferences. Its heartbeat sends only the cached boolean. It does not query the carrier, confirm the destination, or detect a forwarding change made outside the app.

This creates the most important response nuance in the campaign. Call forwarding is carrier-side state. Once activated, it can persist after the app is uninstalled, its data is cleared, or its components are disabled. The self_destroy command does not call the forwarding-cancellation routine. Removal of the APK is therefore not evidence that call diversion has ended.

Corp MDM operator panel #

The same infrastructure exposed a password-protected Corp MDM admin panel on port 3456. Its login page used generic mobile device management branding over a CEVA-themed logistics background, visually linking the delivery lure, implant identity, and operator interface.

The authenticated interface presented device-management and tasking controls, but visible panel features are not equivalent to implemented client behavior. The recovered APK supports only the subset described below.

Command surface versus panel claims #

The client command dispatcher recognizes five values. Two additional controls visible in the saved operator panel are not supported by this build.

self_destroy disables the activity, receivers, and service, stops foreground execution, and asks Android to clear application data. It does not uninstall the package. The code explicitly kills its process only if the clear-data request throws an exception.

The panel also claims server-side device deletion and denylisting. That operator-interface claim is not reflected in the client APK.

Cleartext C2 and brittle telemetry #

The app hardcodes in its build configuration and API client. Android cleartext traffic is explicitly allowed in the manifest.

We assess with medium confidence that the wider activity has an Armenian or Russian nexus. Within Corp MDM itself, the clearest localized artifact is Armenian. The operator panel prefills +374 for both the stored device phone number and the call-forwarding destination. The International Telecommunication Union assigns +374 to Armenia . Because these values appear as operator-side defaults rather than victim-derived telemetry, they likely reflect assumptions made during development or operation.

The Russian component of the assessment derives from source code elsewhere in the wider campaign and is not independently established by this APK or panel. The overlap with Diesel Vortex is limited to logistics-sector targeting and a cargo-theft objective. We do not have evidence that this is the same threat group.

Detection and response #

High-value behavioral sequence #

a logistics-themed Google Play clone directs the target to sideload an APK

the package com.corp.mdm , labeled System Service , presents a full-screen setup flow

the setup requests SMS, telephone, and notification permissions

MainActivity starts MdmService , disables its own component, and exits

BootReceiver restarts registration and the sticky foreground service after boot or package replacement

the implant registers the handset with 69.55.61[.]82:3456 over cleartext HTTP

SmsReceiver sends each newly received SMS PDU to /api/v1/sms/report

the service polls for commands that can request call forwarding, cancellation, liveness checks, or local cleanup

the package name com.corp.mdm or APK SHA-256 61954bab16df91e7a1c940a2bdd5a5cf3c61b529a7c75a5ff21ac78f15c61a86

an application labeled System Service with a disabled launcher activity and active foreground service

the notification channel System Service , notification title Android System , or message System service running.

MdmService , BootReceiver , and SmsReceiver components in an unfamiliar sideloaded package

cleartext HTTP traffic to 69.55.61[.]82:3456 , particularly the registration, heartbeat, command, result, and SMS-report routes

the local preference keys forward_active and forward_number

Isolate affected Android devices and preserve the APK, package state, logs, and network evidence before cleanup. Revoke the application's SMS and telephone permissions, remove the package, and check for other applications installed from the same delivery source.

Verify call-forwarding state independently through the carrier or a trusted device workflow, then cancel any unauthorized diversion. Neither package removal nor the implant's self_destroy command proves that carrier-side forwarding has ended.

Treat SMS content received while the implant was active as exposed. Invalidate affected sessions and rotate credentials for accounts whose one-time codes, password resets, recovery messages, or transaction notifications may have reached the device.

Corp MDM is a focused Android surveillance implant delivered through logistics-themed Google Play impersonation. This spyware has only been observed targeting the logistics sector, where adversaries seek information that can facilitate cargo theft. The wider campaign used the same logistics targeting in attempts to steal credentials and deploy malware on Windows hosts.

After launch, the app uses a fake system setup to request SMS and telephone permissions, hides its launcher activity, maintains a foreground service, restarts after boot or package replacement, and identifies the handset with ANDROID_ID . It exfiltrates each newly received SMS PDU and polls a cleartext, unauthenticated C2 for call-forwarding, liveness, synchronization-stub, and cleanup commands.

The durable response lesson is telephony state. Removing the APK, clearing its data, or observing its self-destruction does not automatically cancel call forwarding. Forwarding must be verified independently with the carrier or device after containment.

The tactics, techniques, and procedures (TTPs) below use MITRE ATT&CK technique identifiers. Indicators of compromise (IOCs) follow in exportable lists grouped by type.

MITRE ATT&CK for Mobile

International Telecommunication Union, List of Recommendation E.164 assigned country codes

Have I Been Squatted, Diesel Vortex: Inside the Russian cybercrime group targeting US and EU freight

Detect adversary infrastructure while it is being staged.

Have I Been Squatted helps security teams detect lookalike domains, certificate and DNS changes, and staging infrastructure, investigate the evidence, and coordinate takedowns.