July 18, 2017 By Shane Schick 2 min read

An Android-based backdoor threat known as GhostCtrl could allow cybercriminals a scary range of capabilities. A successful exploit may enable actors to do everything from using text-to-speech tools and connecting to other devices using Bluetooth to stealing data, researchers recently warned.

The Evolving Threat

The threat was first detailed in a blog post from Trend Micro, which said that GhostCtrl has had at least three iterations but showed unusual capabilities in its latest version. Researchers believed that the backdoor was developed from OmniRAT, a remote access tool (RAT) that first emerged as a security threat in 2015.

Unlike some more limited pieces of malware, there’s a laundry list of things the backdoor could do. This included hanging up on phone calls, recording audio, playing sound effects and resetting passwords, Trend Micro noted.

According to Help Net Security, GhostCtrl may dupe potential victims by posing as popular apps such as “Pokemon Go” or WhatsApp. Once downloaded, however, it launches a malicious Android application package (APK) that uses a wrapper to hide in the background without an icon on the user’s smartphone screen.

GhostCtrl Has Wider Impact, Longer Reach

GhostCtrl represents more than just an annoyance to consumers. It has already been used to target health care organizations in Israel, Bleeping Computer reported, looking for information to offer via underground criminal networks. It can also be used as a ransomware tool, displaying a note demanding money after locking victims out of their devices.

There’s a wealth of information available for the creators of GhostCtrl to hijack, Trend Micro added. Phone records, subscriber identity module (SIM) serial numbers, operating system (OS) versions, browser searches and more — this is a backdoor with long reach. Even if potential victims suspect they’re in danger, the cybercriminals behind it keep running pop-ups until users are worn down and allow installation to take place.

There are still ways for Android users to ward off GhostCtrl, such as hardening security policies in their settings and making use of antivirus tools. Being vigilant is key, however, since the backdoor will display the Android name as it seeks access to the command-and-control (C&C) server to look more like a bona fide process.

More from

Poland spending $760 million on cybersecurity after attack

3 min read - Visitors to the Polish Press Agency (PAP) website on May 31 at 2 p.m. Polish time were met with an unusual message. Instead of the typical daily news, the state-run newspaper had supposedly published a story announcing that a partial mobilization, which means calling up specific people to serve in the armed forces, was ordered by Polish Prime Minister Donald Tusk beginning on July 1, 2024. Deputy Prime Minister Krzysztof Gawkowski refuted the claim on X (formerly Twitter). His post…

How generative AI Is expanding the insider threat attack surface

3 min read - As the adoption of generative AI (GenAI) soars, so too does the risk of insider threats. This puts even more pressure on businesses to rethink security and confidentiality policies.In just a few years, artificial intelligence (AI) has radically changed the world of work. 61% of knowledge workers now use GenAI tools — particularly OpenAI’s ChatGPT — in their daily routines. At the same time, business leaders, often partly driven by a fear of missing out, are investing billions in tools…

Water facilities warned to improve cybersecurity

3 min read - United States water facilities, which include 150,000 public water systems, have become an increasingly high-risk target for cyber criminals in recent years. This rising threat has demanded more attention and policies focused on improving cybersecurity.Water and wastewater systems are one of the 16 critical infrastructures in the U.S. The definition for inclusion in this category is that the industry must be so crucial to the United States that “the incapacity or destruction of such systems and assets would have a…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today