Date: September 24, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Mobile Security / Cyber Espionage & Logistics / Malware Analysis
Tags: Corp MDM, Android Spyware, Logistics Security, 2FA Interception, Call Forwarding, CEVA Logistics, Threat Intelligence
Executive Summary
On September 24, 2026, security researchers at threat intelligence group Have I Been Squatted and The Hacker News published an investigative briefing uncovering a targeted cyber-surveillance campaign against the global logistics and freight transportation sector. The campaign weaponizes a novel, compact Android spyware family codenamed Corp MDM (package name: com.corp.mdm), designed to masquerade as an enterprise Mobile Device Management (MDM) utility.
Distributing malicious payloads through convincing, brand-spoofed Google Play Store landing pages targeting multi-national shipping giants CEVA Logistics and TKW Logistics, the attackers deceive fleet drivers, dispatchers, and logistics managers into sideloading the trojanized application onto corporate and personal Android devices.
Once installed, Corp MDM operates as an invisible surveillance implant. It intercepts all incoming SMS messages—specifically harvesting multi-factor authentication (MFA) codes, bank transaction verifications, and freight dispatch tokens—and exfiltrates them over HTTP to an attacker-controlled command-and-control (C2) server. Furthermore, the malware possesses the rare capability to trigger unconditional call forwarding on the victim's phone, allowing threat actors to reroute critical voice verification calls and freight coordination directly to operator burner phones.
Technical Deep-Dive: Dissecting the Corp MDM Attack Chain
The logistics sector represents an enticing target for financially motivated syndicates: intercepting dispatch communications, bill-of-lading data, and fuel payment card credentials allows adversaries to conduct cargo diversion, fuel theft, and corporate invoice redirection fraud.+-----------------------------------------------------------------------------------+
| CORP MDM INTRUSION AND EXFILTRATION |
|---|
Victim Mobile Device (Android) Attacker C2 Infrastructure
| (69.55.61[.]82:3456)
| 1. Lured via SMS/Phishing to Spoofed Store: |
| `playgoogle.ceva-app[.]help` |
| `playgoogle.logisticstkwcargo[.]com` |
| |
| 2. Sideloads APK (`com.corp.mdm`) |
| Dressed up as "System MDM Service" |
| |
| 3. Requests Permissions & Removes Launcher Icon: |
| - `RECEIVE_SMS`, `READ_PHONE_STATE`, `CALL_PHONE` |
| - Establishes hidden foreground service |
| |
| 4. Device Registration: |
| POST /api/v1/devices/register --------------------->| (Logs Android ID & Model)
| |
| 5. Continuous Heartbeat (every 30s): |
| POST /api/v1/devices/heartbeat -------------------->|
| |
| 6. Operator Dispatches Command via Web Panel: |
| - `forward_on` (Dial `*21*[ATTACKER_PHONE]#`) |
| - `sync_sms` / `self_destroy` |
| <---------------------------------------------------|
| |
| 7. Intercepts Real-Time Inbound SMS: |
| - Banking OTPs, Fleet Fuel PINs, Dispatch Data |
| |
| 8. Exfiltration over Cleartext HTTP: |
| POST /api/v1/sms/report --------------------------->| (Phone, Body, Timestamp)
| |
| 9. Voice Call Rerouting Triggered: |
| Dispatches unconditional call forward code -------->| (Diverts Dispatcher Calls)
1. Delivery Architecture and Brand Impersonation
The threat actors engineered domain typosquatting infrastructure designed to deceive logistics personnel into believing they were accessing mandatory corporate software from the official Google Play store:
* playgoogle.logisticstkwcargo[.]com (Impersonating TKW Logistics)
* playgoogle.ceva-app[.]help (Impersonating CEVA Logistics)
Both domains routed to identical infrastructure hosted on a hardcoded IP address: 69.55.61[.]82. This single server served as a Swiss-army knife for the operation—hosting the phishing landing pages, staging the Android APK downloads, and maintaining Windows-based infostealer payloads aimed at desktop dispatch terminals.
2. Permissions Hijacking and Stealth Execution
Upon installation, Corp MDM requests three critical Android runtime permissions:
* android.permission.RECEIVE_SMS: Grants real-time programmatic access to incoming cellular text messages via broadcast receivers.
* android.permission.CALL_PHONE: Enables the malware to initiate outgoing telephone calls and dial USSD codes without requiring user confirmation.
* android.permission.READ_PHONE_STATE: Allows the malware to fingerprint SIM card identifiers, IMEI numbers, and network operator parameters.
To ensure survival and evade user detection:
* The app programmatically disables its own launcher activity (PackageManager.setComponentEnabledSetting), effectively vanishing from the Android application drawer and home screen.
* It registers a sticky foreground service disguised as an essential operating system process, bypassing Android's battery-saving Doze mode to maintain continuous background execution.
3. C2 Telemetry and REST API Protocol
Corp MDM establishes communications with its backend C2 on http://69.55.61[.]82:3456/ using a clean, well-structured REST API:
API Endpoint
Method
Technical Functionality
/api/v1/devices/register
POST
Transmits device hardware specifications, OS version, Android ID, and carrier information.
/api/v1/devices/heartbeat
POST
Dispatches an operational ping every 30 seconds to confirm the implant remains active.
/api/v1/devices/{ANDROID_ID}/commands
GET
Polls the command queue at rapid intervals to fetch operator instructions.
/api/v1/commands/result
POST
Returns execution status flags (e.g., successful call forward activation).
/api/v1/sms/report
POST
Transmits stolen SMS metadata: sender address, plaintext message body, and millisecond timestamp.
4. Real-Time SMS Interception and Call Redirection
Unlike heavy commodity spyware frameworks that crawl the SQLite database of historical messages, Corp MDM is engineered with a lean, event-driven architecture:
* Real-Time Stream Sniffing: When an inbound SMS arrives, the malware's BroadcastReceiver intercepts the android.provider.Telephony.SMS_RECEIVED intent. It captures the raw SMS PDU, extracts the body, and immediately posts it to /api/v1/sms/report. Because modern two-factor authentication (2FA) and password resets arrive via SMS, the attackers harvest OTP codes within seconds of generation.
* Unconditional Call Forwarding: When the operator issues the forward_on command, the malware utilizes Android telephony APIs to dial a standard GSM MMI/USSD string: *21*[TARGET_PHONE]#. This instructs the cellular carrier to unconditionally forward all incoming voice calls to an attacker-controlled telephone number. A subsequent forward_off command dials ##21# to cancel forwarding once fraudulent transactions or identity verifications are completed.
5. Evidence of AI-Assisted Development & Threat Actor Nexus
Researchers identified peculiar implementation anomalies within the decompiled Java codebase. While the API communications are modular and structured, several declared features—such as get_location and lock_device—are fully present in the operator's web panel but lack corresponding client-side execution handlers in the APK. Furthermore, the presence of redundant error handlers and boilerplate scaffolding suggests that the threat actor utilized commercial coding assistants (LLMs) to rapidly assemble the mobile implant.
Linguistic artifacts, UI strings in the web panel, and overlapping infrastructure connect this activity to an Armenian/Russian cybercrime nexus. The campaign shares significant operational overlaps with previously documented threat clusters Diesel Vortex and Global Profit (aka MC Profit Always), which have systematically targeted logistics platforms including Penske Logistics, TIMOCOM, and DAT Truckstop since 2025.
Strategic Threat: The Fragility of Supply Chain Identity
The emergence of Corp MDM highlights systemic identity vulnerabilities within the transportation and logistics ecosystem:
1. SMS OTP Vulnerability: Logistics operators, third-party freight carriers, and independent truckers rely heavily on SMS-based two-factor authentication to access load boards, fuel card portals (e.g., Fleet One, EFS), and billing systems. Intercepting SMS in real time renders standard 2FA completely ineffective.
2. Double-Brokering and Cargo Hijacking: By combining SMS theft with call redirection, adversaries can impersonate legitimate freight dispatchers, accept high-value freight loads, reroute shipments to illicit warehouses, and collect carrier payments before the legitimate parties discover the fraud.
3. The Danger of BYOD and Unmanaged Sideloading: Drivers and contracted personnel frequently use personal devices to interface with corporate logistics apps, creating a porous perimeter where unauthorized APK installations are common practice.
Indicators of Compromise (IoCs) & Defensive Mitigations
1. Indicators of Compromise (IoCs)
Network Indicators:
- 69.55.61[.]82 (C2 Server / Phishing Host / Admin Panel port 3456)
- playgoogle.logisticstkwcargo[.]com (Malicious Distribution Domain)
- playgoogle.ceva-app[.]help (Malicious Distribution Domain)
Host & Package Indicators:
- Package Name: com.corp.mdm
- Target Application Labels: "CEVA Logistics MDM", "TKW Cargo Service"
2. Defensive Countermeasures for Logistics Organizations
* Ban Sideloading via Enterprise MDM: Mandate that all mobile devices accessing enterprise corporate networks or dispatch portals be enrolled in verified, legitimate MDM solutions (e.g., Microsoft Intune, VMware Workspace ONE, Google Workspace Endpoint Management). Enforce policies prohibiting third-party APK sideloading (disallow_install_unknown_sources).
* Phase Out SMS 2FA for Phishing-Resistant MFA: Replace SMS-based one-time passcodes with FIDO2/WebAuthn hardware security keys or authenticator apps (TOTP / push verification with number matching).
* Cellular Carrier SIM & Forwarding Audits: Work with corporate mobile carriers to block remote MMI/USSD call forwarding commands (*21*) across enterprise-managed phone lines.
* Educate Fleet and Dispatch Personnel: Conduct targeted security awareness training warning dispatchers and drivers against clicking SMS or WhatsApp links purporting to deliver mandatory corporate app updates.
Conclusion
Corp MDM represents a focused, purpose-built mobile weapon tailored to exploit the operational seams of the global supply chain. By masquerading as the very tool designed to secure enterprise fleets, the malware turns trusted mobile endpoints into covert wiretaps. Organizations must urgently eliminate SMS-based authentication and enforce strict application sandboxing across their mobile workforces.
For continuous coverage of supply chain and mobile threats, visit Digital Spying.