Hacker group inserted malware in NoxPlayer Android emulator

Attackers targeted only a handful of victims. Only five detected until now, in countries such as Taiwan, Hong Kong, and Sri Lanka.
Written by Catalin Cimpanu, Contributor
Image: BigNox, ZDNet

A mysterious hacking group has compromised the server infrastructure of a popular Android emulator and has delivered malware to a handful of victims across Asia in a highly-targeted supply chain attack.

The attack was discovered by Slovak security firm ESET on January 25, last week, and targeted BigNox, a company that makes NoxPlayer, a software client for emulating Android apps on Windows or macOS desktops.

ESET says that based on evidence its researchers gathered, a threat actor compromised one of the company's official API (api.bignox.com) and file-hosting servers (res06.bignox.com).

Using this access, hackers tampered with the download URL of NoxPlayer updates in the API server to deliver malware to NoxPlayer users.

"Three different malware families were spotted being distributed from tailored malicious updates to selected victims, with no sign of leveraging any financial gain, but rather surveillance-related capabilities," ESET said in a report shared today with ZDNet.

Despite evidence implying that attackers had access to BigNox servers since at least September 2020, ESET said the threat actor didn't target all of the company's users but instead focused on specific machines, suggesting this was a highly-targeted attack looking to infect only a certain class of users.

Until today, and based on its own telemetry, ESET said it spotted malware-laced NoxPlayer updates being delivered to only five victims, located in Taiwan, Hong Kong, and Sri Lanka.

Image: ESET

ESET has released today a report with technical details for NoxPlayers to determine if they received a malware-laced update and how to remove the malware.

ESET said BigNox denied having been hacked last week. After this article went live, a BigNox spokesperson told ZDNet in an email that they've now engaged with ESET to investigate the breach further and that initial communications were only a misunderstanding.

The Hong Kong-based company also said it deployed several countermeasures and security updates since it learned of the hack, such as:

  • use only HTTPS to deliver software updates in order to minimize the risks of domain hijacking and Man-in-the-Middle (MitM) attacks
  • implement file integrity verification using MD5 hashing and file signature checks
  • adopt additional measures, notably encryption of sensitive data, to avoid exposing users' personal information

ESET rules out cybercrime operation

As for who's behind the attack, ESET doesn't know, but it knows who it wasn't.

"We discard the possibility that this operation is the product of some financially motivated group," an ESET spokesperson told ZDNet today via email.

"We are still investigating, but we have found tangible correlations to a group we internally call Stellera, which we will be reporting about in the near future."

These correlations referred to the three malware strains deployed via malicious NoxPlayer updates, which ESET said contained "similarities" to other malware strains used in a Myanmar presidential office website supply-chain compromise in 2018 and early 2020 in an intrusion into a Hong Kong university.

This incident is also the third supply chain attack discovered by ESET over the past two months. The first is the case of Able Desktop, software used by many Mongolian government agencies. The second is the case of the VGCA, the official certificate authority of the Vietnamese government.

Updated at 3:30pm ET with comments from ESET. Updated again on February 2, at 7:20am ET and February 4, at 6:15pm ET, with a statement from BigNox.

The world's most famous and dangerous APT (state-developed) malware

Editorial standards