trickywonders

TrickyWonders is a financially motivated cybercriminal threat actor associated with Android banking trojan and SMS-stealer activity targeting users in Uzbekistan, particularly Telegram users. Group-IB identified it as one of the three main threat actors targeting Uzbekistan alongside Ajina and Blazefang. The group is behind the Wonderland SMS stealer, formerly known as WretchedCat, and is also attributed to the dropper malware families MidnightDat and RoundRift. The group operates a hierarchical, profit-driven affiliate model. Owners and core developers maintain the malware codebase and command-and-control infrastructure, while affiliates or "workers" distribute malicious APKs in exchange for a share of stolen funds. Telegram is used as the primary coordination platform, and malicious APKs are generated and distributed through this ecosystem. TrickyWonders distributes malware through Telegram, social engineering, fake websites, fake Google Play pages, Facebook ads, dating apps, and sideloaded Android APKs masquerading as legitimate applications. The group abuses stolen Telegram sessions to message victims and propagate malware through victims' contact lists. Lures are tailored to local language, culture, and themes such as financial aid programs and local events. Wonderland is used to exfiltrate SMS messages, including banking one-time passwords, hijack Telegram accounts by intercepting authentication codes, retrieve phone numbers, exfiltrate contact lists, hide push notifications, send SMS for lateral movement, and enable unauthorized financial transactions. Group-IB reported that the malware can repeatedly withdraw funds from victims' cards until access to the device is lost. Wonderland supports bidirectional command-and-control for real-time attacker control, including remote USSD requests and SMS theft. TrickyWonders uses heavily obfuscated droppers and anti-analysis techniques to conceal payloads and evade detection. The group shifted from directly distributing stealers to using droppers that appear benign while embedding the stealer deeper inside, allowing samples to pass many standard security checks. The operation also rotates infrastructure domains and malicious package names frequently to complicate monitoring and blacklisting. Group-IB described this as a significant increase in operational maturity. Known associated malware and related activity mentioned in the content include Wonderland/WretchedCat, MidnightDat, RoundRift, and Qwizzserial. TrickyWonders was first discovered in November 2023.