Poseidon’s Offspring: Charybdis and Scylla

Researchers: Nico Agnese, Vikas Parthasarathy, Joao Santos, Adam Sell, Inna Vasilyeva

In this post:

• HUMAN’s Satori Threat Intelligence & Research team discovered an operation we’re calling Scylla (pronounced SILL-uh). It’s the third wave of an attack we first reported in August 2019; the second wave, which we’re calling Charybdis (pronounced kuh-RIB-diss), cropped up in late 2020.
• The attacks target a number of advertising SDKs within apps available via both Google’s Play Store and Apple’s App Store.
• Apps associated with the Scylla operation have been downloaded 13+ million times.
• This attack is ongoing; HUMAN and the Satori team continue to pursue the operation and its perpetrators.

Introduction

“Modern defense” is the strategy behind protecting the internet and the advertising ecosystem from fraud through a combination of internet observability, collective protection, and actionable intelligence with disruptions of fraud operations when they’re uncovered. This strategy is the basis of how HUMAN works to safeguard the internet from digital attacks, disrupt the economics of cybercrime, and reduce the cost of collective protection for customers.

Three years ago, in August of 2019, HUMAN’s (then White Ops) Satori team reported about a collection of 40+ Android apps openly committing multiple types of advertising fraud. That investigation, which we named Poseidon after the malicious code within the apps, resulted in Google removing the apps from their Play Store.

A disruption that results in dismantling the infrastructure powering a fraud scheme is rare. In the case of the original Poseidon operation, we weren’t in a position to disrupt the infrastructure in that way, but we were able to work with the Google Play Store team to remove the malicious apps and ensure that the proliferation of that wave of the scheme stopped.

Poseidon is back again, unsurprisingly. This adaptation, which we’ve dubbed Scylla, showcases new tactics and techniques these threat actors have deployed to try and cover their tracks better than in earlier adaptations.

They have also expanded their attack to more parts of the digital advertising ecosystem, further underscoring the importance of collective protection to stop fraud at the source:

• The Scylla operation featured 75+ Android apps and 10+ iOS apps committing several flavors of ad fraud. These apps generated 13+ million downloads in total before they were taken down.
• Satori partnered with the security teams at Google’s Play Store and Apple’s App Store. HUMAN provided indicators of compromise (IOCs) and other evidence involving the malicious Scylla code. Google and Apple responded promptly to the threat, expanding the ring of apps and removing them from their respective stores.
• HUMAN’s customers are protected from attacks on the digital advertising ecosystem through our media security solutions, including MediaGuard.

Poseidon, the father

Before we can dive into the specifics of how the Charybdis and Scylla operations worked, it’s helpful to have the context of how the original Poseidon phase of the scheme functioned and how the Satori team found it.

The 2019 Poseidon operation consisted of more than 40 Android apps openly committing ad fraud within their code. The apps in question displayed ads out of context or hidden from view of the device user, both of which are classic mechanisms within the broader ad fraud category of Misleading User Interface (PDF).

What made the Poseidon operation interesting was its use of “receivers” to trigger these ads to load. Receivers are, generally speaking, useful little bits of code that tell an app when something has changed with respect to the device. For example, a receiver monitors when a phone has been put into Airplane Mode, and then instructs the app to stop trying to connect to the internet until Airplane Mode is turned off again.

However, well-intended and useful elements of code can be twisted to serve criminal goals. In the case of Poseidon, a receiver designed to determine if the phone was on and in use—a USER.PRESENT receiver—was key to instructing the host apps to call for ads to be shown out-of-context or hidden from the user’s actual view.

The threat actors behind Poseidon didn’t cover their tracks very well, though, as all of the code they built into the apps to handle the fraud was out in the open. Once the Satori team reverse-engineered the code segments named for Greek mythological figures—hence, “Poseidon”—the fraud tactics were entirely laid bare. There was no real attempt to obscure the intention of the code. That would change in future iterations of the scheme.

Poseidon, the father; Charybdis, the daughter

Following the original Poseidon attack, which we worked closely with Google’s Play Store team to halt, the Satori team kept an eye on the threat actors to see how they would respond.

This phase of fraud-fighting, the adaptation phase, is a crucial part of changing the economics of cybercrime. Every fraud scheme is a race against time for a threat actor: the fraudsters only have until their scheme is shut down to reap enough profit to recoup their cost of developing and deploying it in the first place. The more that organizations can work together and share information, the more threat-hunters like Satori can discover these fraud schemes and shrink the criminal’s profit window. Eventually, the cycle of operation discovery and dismantling becomes so short that fraudsters won’t have enough time to recoup even their costs, so they’ll move on to another target.

In the later part of 2020 and early into 2021, the Satori team uncovered the second wave of this threat actor’s scheme. This iteration, which we’ve dubbed Charybdis (named for Poseidon’s daughter), evolved from the Poseidon operation in two key areas:

1. Code Obfuscation: The threat actors leveraged a popular developer tool named Allatori, which swaps out elements of code for single letters or numbers, making it very difficult for someone to look at the raw code of an app to understand what exactly it’s supposed to do. There are many legitimate uses for tools like Allatori—much like there are legitimate ways to use many receivers—for example, the developer of a popular app might want to slow down the development of knockoff apps that eat into download numbers and sales. But—much like the case with the use of receivers—the intent is what’s most important. In the case of Charybdis and Scylla, the fraudsters use Allatori to hide the code committing the fraud inside the host apps.
2. SDK Targeting: The original Poseidon scheme did not target any specific advertising platform via the code buried inside the host apps. With Charybdis, however, Satori researchers were able to reverse the obfuscated code and discovered targeting of specific well known advertising platforms and systems.

Poseidon, the father; Charybdis, the daughter; Scylla, the granddaughter

HUMAN’s Satori team has uncovered a collection of 75+ apps on Google’s Play Store and 10+ apps on Apple’s App Store that contained obfuscated code similar to Charybdis. This third and latest phase of the operation is named for Scylla, Poseidon’s granddaughter and a sea monster like Charybdis. These apps, when installed, commit several different flavors of advertising fraud:

• App and Bundle ID Spoofing: this is when an app contains code that tells advertisers and ad tech companies that it’s a different app entirely, with the intent of tricking those companies into placing ads there (if it’s pretending to be an especially popular app) or into spending more money to place ads (if it’s pretending to be something else entirely, like a streaming service).
  
  The Scylla apps contained code that pretended to be other, legitimate games for advertising purposes, helping to keep their operation quiet.
• Out of Context (OOC) and Hidden Ads: this is when ads are shown in a situation where ads should not be shown, or are rendered in a way that a user cannot possibly see them. For example, if your phone randomly displays an ad on your home screen, that’s an out of context ad that a bad app is prompting. Alternatively, sometimes, apps will try and sneak extra ads in but not show them to a user. The ads still count as having been “viewed” with the fraudulent code faking viewability metrics, which means the fraudster makes money, but no ad was actually visible.
  
  In the case of Scylla, the Receiver code (described above) would trigger when the apps weren’t open. For example, triggering when a device was simply unlocked on the home screen.
• Fake Clicks: Every advertiser knows that clicks are more valuable than impressions. And many advertising programs are set up to bill that difference accordingly. So, naturally, fraudsters are eager to develop ways to make it look like the ads being shown are also being clicked; they make more money as a result.
  
  Code within the Scylla apps is built to take information from real clicks—like the timing of a real person’s click of an ad and where on the ad they clicked it—and then send that information again as a fake click to cash in.

Also new in the Scylla attack is the expansion from targeting advertising SDKs focused on Android apps into targeting iOS apps as well:

Wood Sculptor, an iOS app associated with Scylla
Source: Satori Threat Intelligence and Research Team

Above, you can see a game called Wood Sculptor. The app is a knock-off of a popular game in which the user slices a path on a flat surface to allow a predetermined shape to pass through the resulting opening. Satori researchers who downloaded Wood Sculptor never saw any ads displayed during the game’s operation.

Packet capture from Wood Sculptor
Source: Satori Threat Intelligence and Research Team

Above, a packet capture of activity from Wood Sculptor. Note the numerous calls to ad servers. Below, execution traces show additional web views where the ads called above are rendered invisible to the user.

UI elements identifying the location of webviews for ads rendered through Wood Sculptor
Source: Satori Threat Intelligence and Research Team

How Scylla Worked

Spoofing

Many of the operations that our Satori team has uncovered use app or bundle ID spoofing as a primary fraud mechanism. Our PARETO investigation, for example, uncovered 29 Android apps that were pretending to be more than 6,000 CTV-based apps, which generally carry higher prices for advertisers than the average mobile game.

In layman’s terms, the threat actors code their apps to pretend to be other apps for advertising purposes, often because the app they’re pretending to be is worth more to an advertiser than the app would be by itself. They do this by inserting a different “bundle ID” or “app ID” (think driver’s license) in the code. Additionally, since some ad verification platforms can catch tactics like these by looking for frequently-faked bundle IDs, the threat actors will cycle through these IDs to avoid getting caught.

The apps in the Scylla operation are instructed which bundle ID to use by a remote command-and-control (C2) server, which tells the app which bundle ID to dynamically insert in the code for that specific impression opportunity, all in a matter of milliseconds.

BundleId spoofing within Scylla
Source: Satori Threat Intelligence and Research Team

The above screenshot is taken from a game called “Lady Run”. The bundle ID, however, names a different app entirely, a game called “War in Painting”.

Response from C2 server with spoofing instructions
Source: Satori Threat Intelligence and Research Team

Here is a decrypted snippet of the C2 server’s response. The app, in this case, is being told to mimic the app ID of a game called Balloon Shooter.

OOC/Hidden Ads

Many mobile apps show an ad as part of their loading screen - it’s a common enough mechanism that most of us wouldn’t think twice about seeing an ad when opening an app.

What’s not common, however, is for the app to tell advertising platforms that it has displayed an ad to the user without having ever actually done so.

Loading a Scylla-associated app
Source: Satori Threat Intelligence and Research Team

The above gif seems straightforward - a game is opened, there’s a brief loading screen, and then the game is ready to play. However, what the phone user does not see is that multiple virtual screens (aka “webviews”) are launched in a way hidden from the user. These webviews are loaded with ads, tricking advertisers into paying for fake impressions to an audience that is never there.

WebView of traffic of the Scylla-associated app
Source: Satori Threat Intelligence and Research Team

As you can see in the above log, several windows rendered…but not where the user could see them. Here is a sample of the actual ads which were “loaded” to the off screen WebViews:

Source: Satori Threat Intelligence and Research Team

Fake Clicks Using Receiver Code

Earlier in this post, we described the purpose of Receivers within apps: they’re helpful in determining when a device is being actively used (or not) and when a device is well-suited for an ad to run (or not). Scylla’s designers abuse these device functions to find the ideal times to “serve” ads when they won't actually be seen. To fully understand how they accomplished this, we have to start with the JobScheduler.

View of JobScheduler within a Scylla-associated app
Source: Satori Threat Intelligence and Research Team

JobScheduler schedules a job for Android apps or devices, as the name might suggest. In the Scylla operation, JobScheduler tells the app to run certain activities (like ads) when the correct conditions are met. To figure out if those conditions are met, the apps use Receivers.

JobScheduler triggering on on/off/user_present within a Scylla-associated app
Source: Satori Threat Intelligence and Research Team

Above, receivers determine if a device’s screen is on or off and whether the device is actively in use. These determinations feed into the apps’ logic about when and where to show ads.

Listeners triggering a call to the C2 server
Source: Satori Threat Intelligence and Research Team

Much of what you see above is common to what the Satori team witnessed in the Poseidon operation. What’s new in Scylla is how the apps fake actual clicks of the ads in question. Fake clicks can have multiple benefits for the fraudster: for ad networks that bill on a views model, clicks demonstrate effectiveness, which makes advertisers want to stick around. But some other ad networks bill by the click, which incentivizes the fraudster to just fake the clicks to get paid.

Code within Scylla-associated apps log click locations and save them to later fake clicks
Source: Satori Threat Intelligence and Research Team

Above, the host apps track where real clicks happen on the device and store that information to later fake clicks.

But wait, there’s more.

Obfuscation

As noted above, one of the other key differences between the original Poseidon operation and the latest Scylla operation is how well the threat actors manage to cover their tracks. Many of the screenshots above may be difficult to parse for the average observer because bits of the code have been “renamed” in an effort to make it harder for security researchers like our Satori team to reverse engineer.

Above, code from the original Poseidon attack stage with an unobfuscated command. Below, a Scylla app with the same command, now obfuscated with Allatori.
Source: Satori Threat Intelligence and Research Team

Additionally, the bad actors behind Scylla used an unpaid, demo version of Allatori:

Example of use of Allatori code obfuscation tool, deobfuscated for investigation purposes.
Source: Satori Threat Intelligence and Research Team

Navigating Charybdis and Scylla

HUMAN’s Satori team has worked closely with the Google Play Store and Apple App Store to ensure that all of the apps we’ve identified as being a part of the Scylla operation have been removed from public access. We’ve also worked closely with advertising SDK developers to mitigate the impact of the operation to their processes and their advertising partners. Our researchers will continue to monitor the threat actors behind the Poseidon, Charybdis, and Scylla operations for further adaptation.

Customers of HUMAN’s MediaGuard solution are protected from fraud perpetrated by the Scylla operators.

Next Steps

HUMAN and the Satori team recommend the following:

For the public:

• If you have any of the apps listed in the below Indicators of Compromise section on your devices, remove them. Even though HUMAN is monitoring the threat actors, they may update the apps to change how they work, so removing the apps is your best bet.
• Consider reducing your risk of running dangerous apps by considering the source of the application and the trustworthiness of the brands involved. Secondary marketplaces, side-loaded or “cracked” applications may be much higher risk.

For HUMAN clients:

• MediaGuard helps protect you from the impacts of Scylla-related fraud. Please contact your account manager with any questions about the impacts of Scylla to your organization.

For application developers:

• The app-ads.txt initiative (PDF), spearheaded by the IAB Tech Lab, is a key step in protecting you and your applications’ reputations from fraud through spoofing appIDs.

For advertisers:

• Ensure you work closely with supply-side partners whose SDKs follow the OMID protocol for identifying ad-serving apps.

Indicators of Compromise

The below is a list of all of the apps associated with each of the Poseidon family of operations.

Scylla:

Charybdis:

Poseidon:

com.magicvcam.beauty.yoobao.camera

com.onestoke.games.www.puzzlegame

com.time.date.stamp.camera.xixifunction

art.eff.filter.photo.editor

com.jelly.crush.europam.games

com.tools.blur.master.editor

com.mirth.cam.pic

com.mobwontools.pixel.blur.editor

com.blurcam.pro.usefultools

com.magicvcam.tool.beauty.camera

com.mobwontools.pixel.blur.cam

com.camera999.super.photo.editor

com.jelly.bubble.game.pop

com.pic.photo.editor.eraser

com.music.play.hi.cloud

com.puzzle.ygyline.onestroke

com.puzzle.lines1.drawstroke

com.video.nin.cut.face

com.camera.ygysuper.photograph

com.magicvcam.hdmeet.cam008

com.box.checkers.chess.free

com.super.photo.ygy.camera

com.magicvcam.meet.photograph

com.funny.camera.top

com.soon.ygy.photograph.camera

com.video.master.face.fb

com.magicvcam.camera.meet

com.camera.easy.photo.beauty

com.magicvcam.camera.newmeet

com.magicvcam.ygycronus.camera.magic

com.cos.ygy.camera.new

com.jelly.cube.crush.colors

com.photoeditor.background.change

com.connect.dots.maker.drawonelin

com.blur.oceans.flyin

com.magicvcam.mine.ygycamera.magic

com.ygy.find.spot.the.difference

com.candy.crushfunny.toystoys

com.frog.crushtoy.blast

com.magicvcam.ygycamera.magic.tool

com.toy.blast.cube.crush.toysfun

com.magicvcam.photos.ygy.tool.magic