TERRACOTTA

TERRACOTTA

Malware creators often try to promote their threatening programs by claiming to give users the ability to win great prizes or get some freebies. The same strategy is being employed by the operators of a new Android botnet called TERRACOTTA. The project specializes in ad-fraud – a common strategy that Android malware uses to generate currency fort its creators. Cybersecurity experts have been able to track TERRACOTTA's activity back to the winter of 2019, and they suspect that this is the period in which the botnet started to grow rapidly. As of June 2020, over 65,000 Android devices were enslaved by the botnet.

Usually, fraudulent applications that pack corrupted code are taken down rather swiftly by the Google Play Store and 3rd-party application stores. However, somehow, TERRACOTTA's creators have managed to use over 5,000 applications that were available for public download for a long time. Allegedly, the users who downloaded these applications did not feel the need to report them for fraudulent activity – this is owed to the fact that the applications linked to the TERRACOTTA do not display visible advertisements. Instead, they click on advertisements in the background silently, without making the computer owners aware of this activity. This way, the botnet's operators end up defrauding not just Android users, but online advertisers as well – estimates show that the TERRACOTTA botnet may have generated over 2 billion impressions.

The applications used to deliver the TERRACOTTA to Android devices were often marked as giveaway utilities, or handful applications – for example, a large portion of the botnet's downloads were generated via applications promising free coupons, sneakers, clothing, and even dental treatments. The TERRACOTTA botnet also relied on fake applications that promised to enhance features of Snapchat, the Android camera application, and more.

The TERRACOTTA Android botnet is not impressive in terms of size, certainly, but it has managed to lay low for a long time by not giving its victims any reasons to report the fake applications. Many of the users who downloaded the threatening applications may have simply thought that they did not end up winning any prizes and there is nothing wrong with the application. It is recommended to keep your device secure via a reputable Android anti-virus application, as well as stick to downloading verified and popular Android applications with overwhelmingly positive reviews.