Affected Systems

Android devices in the logistics sector, specifically targeting CEVA Logistics and TKW Logistics employees. Malicious APK distributed via fake Google Play pages at playgoogle.logisticstkwcargo[.]com and playgoogle.ceva-app[.]help. C2 infrastructure hosted at 69.55.61[.]82.

Exploitation Status

Active campaign confirmed. Malicious APK files are being distributed via fake Google Play pages. Threat actor operates admin panel on port 3456 to control infected devices. Campaign linked to broader logistics-sector targeting with credential phishing and Windows malware.

Business Impact

Logistics firms face SMS interception (including OTPs, password resets, delivery updates), call forwarding to attacker-controlled numbers, and device surveillance. Exfiltration occurs over cleartext HTTP. Credential theft enables invoice redirection, double-brokering fraud, and fund theft. Suspected Russian-Armenian nexus with ties to Global Profit PhaaS platform. No CVE assigned; sideloading required for infection.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Block network traffic to 69.55.61[.]82 and domains playgoogle.logisticstkwcargo[.]com and playgoogle.ceva-app[.]help at firewall and DNS level
  • Hunt for Android package com.corp.mdm on corporate mobile devices; check for sideloaded APKs and apps requesting SMS/telephony permissions without business justification
  • Enforce mobile device management (MDM) policies blocking APK sideloading on Android devices used for logistics operations
  • Monitor for HTTP POST requests to /api/v1/sms/report and /api/v1/devices/heartbeat endpoints; investigate devices communicating with unknown IPs on port 3456
  • Educate logistics staff on risks of installing apps from non-official app stores; verify CEVA and TKW Logistics official app distribution channels