Threat Research: zTorg Trojan Variations

This report documents two zTorg Android trojan variants found in Google Play that perform premium-rate SMS fraud and WAP billing abuse: they contact a C2, check IMSI/MCC/MNC to target operators, receive encrypted JSON with URLs or SMS commands that trigger costly SMS or billing pages, and employ stealth (muting device and deleting incoming SMS); detections by zIPS and Kaspersky are noted and the apps had tens of thousands of installs.