SC-018: Mobile Device Compromise¶

Threat Actor Profile¶

JADE SERPENT is a cybercrime group active since 2023, specializing in mobile-first attack campaigns targeting organizations with permissive BYOD (Bring Your Own Device) policies. The group develops custom Android malware disguised as productivity and utility applications, distributed via third-party app stores and targeted phishing messages. Their malware family, internally tracked as DroidHook, combines credential harvesting, screen recording, and corporate data exfiltration capabilities.

JADE SERPENT targets the healthcare and pharmaceutical sectors, where BYOD adoption is high, mobile access to corporate resources is common, and the data (patient records, clinical trial data, drug formulations) commands premium prices on underground markets. Their average intrusion duration is 45–90 days, and they typically exfiltrate 5–20GB of corporate data per compromised device.

Motivation: Financial — stolen healthcare data sold on underground markets ($250–$1,000 per patient record), corporate espionage, and ransomware deployment (secondary objective).

Scenario Narrative¶

Phase 1 — Social Engineering & Malicious App Installation (~25 min)¶

JADE SERPENT targets MedDevice Corp, a medical device manufacturer with 3,500 employees and a BYOD program enrolling ~1,800 personal devices via Microsoft Intune MDM. The group identifies Dr. Rachel Torres, VP of Clinical Research, through LinkedIn reconnaissance. Dr. Torres uses a personal Samsung Galaxy S24 (Android 14) enrolled in MedDevice Corp's Intune MDM for email, Teams, and SharePoint access.

The attacker sends a targeted SMS (smishing) to Dr. Torres's personal phone:

"MedDevice Security: Your corporate account requires re-verification. Install the updated MedDevice Authenticator from: hxxps://meddevice-auth[.]app/download"

The link redirects to a convincing clone of the Google Play Store page for "MedDevice Authenticator" — a trojanized app that bundles legitimate Microsoft Authenticator functionality with the DroidHook malware. The APK is signed with a self-signed certificate (not Google Play Protect verified).

Dr. Torres, believing this is a legitimate IT security requirement, enables "Install from unknown sources" in her device settings and sideloads the application. Upon installation, DroidHook requests the following permissions:

Evidence Artifacts:

Phase 2 — Permission Abuse & Credential Theft (~30 min)¶

With Accessibility Service access, DroidHook begins capturing Dr. Torres's screen activity and keystrokes. Over the next 72 hours, the malware captures:

• Microsoft Intune Company Portal login credentials
• Microsoft Teams authentication token (intercepted during app refresh)
• Corporate email (Outlook Mobile) — read access via Accessibility screen scraping
• VPN credentials for MedDevice Corp's GlobalProtect VPN (entered manually by Dr. Torres)
• SMS-based MFA codes for 3 corporate applications (intercepted via SMS permission)

The malware establishes a C2 channel via Firebase Cloud Messaging (FCM) — a legitimate Google service — making network-based detection extremely difficult because FCM traffic is indistinguishable from normal Android push notification traffic.

DroidHook exfiltrates the following data to a C2 server at 198.51.100.88:

Evidence Artifacts:

Phase 3 — Lateral Pivot to Corporate Network (~30 min)¶

Using Dr. Torres's stolen GlobalProtect VPN credentials, the attacker connects to MedDevice Corp's corporate network from an external IP (203.0.113.155). The VPN does not enforce device compliance checks — any device with valid credentials can connect.

Once on the VPN, the attacker targets the unpatched Jenkins server discovered during Phase 2 network reconnaissance (10.10.12.45:8443). The Jenkins instance runs version 2.387 with a known RCE vulnerability (synthetic CVE). The attacker gains code execution on the Jenkins server and discovers:

• Jenkins credentials store containing 14 sets of credentials (SSH keys, API tokens, database passwords)
• Pipeline configurations referencing production databases at 10.10.50.10 (PostgreSQL) and 10.10.50.11 (MongoDB)
• Deployment SSH keys with access to 8 production servers

The attacker uses Jenkins pipeline credentials to access the MongoDB instance containing clinical trial data — including patient demographics, treatment outcomes, and adverse event reports for MedDevice Corp's flagship cardiac monitoring device.

Evidence Artifacts:

Phase 4 — Detection & Remediation (~25 min)¶

The compromise is detected on 2026-02-22 when the SOC team investigates the Suricata alert for large MongoDB query results. The investigation reveals the full attack chain: smishing → malicious app → credential theft → VPN access → Jenkins exploit → data access.

Detection Timeline:

Remediation Actions:

Evidence Artifacts:

Detection Opportunities¶

MAM vs. MDM Comparison¶

Key Discussion Questions¶

1. Dr. Torres ignored the Google Play Protect warning and sideloaded a malicious app. How do you design security controls for BYOD that don't rely on user judgment while respecting device ownership?
2. The Intune compliance check runs every 8 hours. For a healthcare organization, is this frequency adequate? What compliance check interval would you recommend, and what are the battery/performance tradeoffs?
3. The attacker used Firebase Cloud Messaging for C2 — a legitimate Google service. How do you detect malicious use of legitimate services (FCM, Slack webhooks, Telegram bots) for C2 without blocking legitimate business communications?
4. The attack chain required 5 control failures in sequence (sideloading, compliance delay, VPN without device check, unpatched Jenkins, MongoDB access). How do you prioritize remediation when resources are limited?
5. What mobile-specific incident response procedures are missing from most IR playbooks? How does BYOD complicate evidence collection and forensic analysis?

Debrief Guide¶

What Went Well¶

• Intune MDM did detect the non-compliance — the gap was check frequency and automated response
• Suricata IDS caught the anomalous database query — network monitoring provided the actionable detection
• Selective wipe capability allowed removal of corporate data without affecting personal device content

Key Learning Points¶

• Mobile devices are a primary attack vector for BYOD environments — smishing and malicious app sideloading are the mobile equivalents of phishing and malware
• MDM compliance check frequency matters — 8-hour intervals create a window of exposure that attackers can exploit
• VPN without device compliance is a bypass vector — conditional access must enforce device health before granting network access
• Mobile Threat Defense (MTD) is essential for BYOD — it provides device-level risk assessment without full MDM, detecting malicious apps, network attacks, and OS vulnerabilities
• Internal development tools (Jenkins, GitLab) are high-value pivot targets — they store credentials and have access to production systems

Recommended Follow-Up¶

• [ ] Deploy Mobile Threat Defense (MTD) solution integrated with Intune conditional access
• [ ] Implement MAM policies — containerize corporate data with app protection policies
• [ ] Enforce conditional access for VPN — require compliant, managed device with MTD risk assessment
• [ ] Reduce Intune compliance check interval to 1 hour for high-risk policies
• [ ] Deploy certificate-based VPN authentication — eliminate password-only VPN access
• [ ] Patch and harden Jenkins — remove default credentials, enable audit logging, restrict network access
• [ ] Conduct smishing awareness training for all employees with BYOD enrollment
• [ ] Implement database activity monitoring (DAM) for clinical trial databases

References¶

• Chapter 21: Mobile & IoT Security
• Chapter 16: Endpoint Detection & Response
• Chapter 9: Incident Response Lifecycle
• Chapter 30: Legal, Privacy & Compliance