Corp MDM: Android Spyware Hijacks Logistics SMS and Calls

Rudra Verma, Senior Security Architect & Researcher · 2026-10-17

What: Researchers at Have I Been Squatted disclosed Corp MDM, an Android surveillance implant (package com.corp.mdm, disguised as "System Service") delivered from counterfeit Google Play pages branded for CEVA and TKW Logistics. It steals inbound SMS, toggles USSD call-forwarding, persists across reboots and beacons to a hardcoded cleartext-HTTP C2.

Who & why: The operator panel prefills the Armenian dialling code +374, and the same C2 server hosts credential-phishing lures and Windows malware — placing Corp MDM inside a broader freight-and-logistics fraud operation whose goal is cargo theft, invoice redirection and double-brokering. The implant is narrow, buggy and — per the researchers — likely AI-assisted in development.

Why it matters: Logistics staff live in SMS-based OTP and dispatch workflows. An attacker who receives every inbound text and can silently forward calls owns the second factor. That is enough to complete account takeovers seeded by the same crew's phishing kit. This is a mobile threat with a direct financial-fraud payoff.

◈ Table of Contents

01 Campaign Profile 02 Disclosure Timeline 03 Initial Access & Delivery 04 Technical Deep Dive 05 C2 & Operator Panel 06 Impact & Cargo-Theft Nexus 07 Wider Campaign Links 08 Indicators of Compromise 09 Detection & Hunt Queries 10 MITRE ATT&CK Mapping 11 Mitigation & Hardening 12 Sources & References

🛰️

01 — Campaign Profile

Attribution

Corp MDM is not a commercial spyware suite and not a full-featured RAT. Have I Been Squatted describes it as narrow by design — a single-purpose SMS-and-call implant bolted onto a freight-fraud operation that already had a working phishing pipeline. The interesting part is not the malware's sophistication (it is buggy) but where it sits: it is the mobile OTP-interception module for an operation that monetises stolen logistics accounts.

Attribute	Detail
Implant name	Corp MDM
Package / label	`com.corp.mdm` · displays as "System Service"
Platform	Android (min API 26 / Android 8.0; target API 34)
Disclosed by	Ben Folland · Have I Been Squatted (Sep 22, 2026)
Targeting	Employees of CEVA Logistics and TKW Logistics (freight / supply chain)
Attribution	Unattributed. Suspected Armenian/Russian nexus from panel and campaign artifacts LOW CONFIDENCE
Objective	Intercept SMS OTPs / codes and redirect calls to defeat MFA and enable account takeover
Development note	Researchers assess AI was likely used during development; capability-breaking bugs present
Severity	HIGH (targeted, MFA-defeating, active infrastructure)

Attribution here is a working hypothesis, not a verdict. The Armenian +374 default and Russian-language artifacts come from the operator panel and adjacent Windows malware — they reflect the developers' assumptions, not victim telemetry. Treat "Armenian/Russian nexus" as low-confidence sourcing, and do not brief it as confirmed attribution.

🗓️

02 — Disclosure Timeline

Dated events

Freight-Fraud Operation to Corp MDM Disclosure

Chronology

1Sep 2025 – Feb 2026: The linked "Global Profit" / "MC Profit Always" phishing-as-a-service activity harvests 1,600+ unique logistics credentials from operators of major freight platforms, chasing shipment data, invoice redirection and double-brokering.
2Feb 2026: Ctrl-Alt-Intel and Have I Been Squatted publish on Diesel Vortex, a Russian-nexus cluster targeting US/EU freight (DAT Truckstop, TIMOCOM, Teleroute, Penske). Same sector, cargo-theft goal — assessed as thematically overlapping, not the same group as Corp MDM.
3Jun 3, 2026: The Corp MDM APK signing certificate is generated (self-signed, CN=Corp MDM), giving the earliest firm build marker.
4Sep 22, 2026: Have I Been Squatted publishes the Corp MDM teardown, documenting the fake CEVA/TKW Play pages, the implant internals and the shared C2.
5Sep 24, 2026: The Hacker News amplifies the report, confirming SMS theft, call redirection and the suspected AI-assisted, bug-ridden build.

🎣

03 — Initial Access & Delivery

Vector

There is no exploit and no zero-day. Delivery is pure social engineering: two typosquatted domains render pixel-convincing Google Play clones for logistics brands and hand the visitor an APK that Android must be told to sideload. The lure is the whole exploit.

Counterfeit Play Store Pages

T1660 · Phishing

Two lure hosts impersonate legitimate freight brands and replicate the Play Store UI — navigation chrome, star ratings, reviews, data-safety cards and "your device is compatible" text. Both resolve to the same server and serve an identical APK.

Lure domain	Brand impersonated	APK path
playgoogle.logisticstkwcargo[.]com	TKW Logistics	`/app.apk`
playgoogle.ceva-app[.]help	CEVA Logistics	`/download/app.apk`

The playgoogle. prefix is the tell. Real Play distribution only ever happens from play.google.com — never a subdomain-of-a-lookalike like playgoogle.<brand>.help. Feed both apex patterns (ceva-app[.]help, logisticstkwcargo[.]com) into brand-abuse and newly-registered-domain monitoring.

Sideload & Permission Capture

T1631 · Install

The victim enables "install unknown apps" and sideloads the 6,119,715-byte APK. On first run MainActivity requests the minimal permission set it actually needs, then removes itself from the launcher so the target cannot easily find or reopen it.

Requested permissions (AndroidManifest)

android.permission.RECEIVE_SMS # wake on every inbound text android.permission.READ_SMS # read message content android.permission.CALL_PHONE # dial USSD forwarding codes android.permission.POST_NOTIFICATIONS # Android 13+ foreground-service notice

Notice what is not requested: no accessibility service, no device-admin, no contacts, no location. The narrow permission profile is deliberate — it draws less scrutiny at install time and from mobile-threat-defense heuristics that key on the usual overlay/accessibility abuse. Do not assume "few permissions" equals "low risk."

🔬

04 — Technical Deep Dive

Implant internals

Corp MDM is a small, readable Android app organised around a handful of named classes. The build is honest about what it is — the code is not heavily obfuscated — which makes the teardown clean. Below is how each moving part actually works.

Class	Role
MainActivity	Requests permissions on first launch, then disables its own launcher component to hide
MdmService	Foreground service; returns `START_STICKY` so Android respawns it
MdmApp	Application subclass / init glue
BootReceiver	Restarts the service on `BOOT_COMPLETED` and package replacement
SmsReceiver	Broadcast receiver on `SMS_RECEIVED`; parses PDUs and exfiltrates
CallForwardManager	Builds and dials USSD forwarding codes via telephony
ApiClient	HTTP client for register / heartbeat / command / result / SMS endpoints

SMS Interception & Exfiltration

T1636.004

SmsReceiver registers for the android.provider.Telephony.SMS_RECEIVED broadcast. For each PDU it extracts sender, body and timestamp, attaches the device ANDROID_ID, and POSTs the record to the C2 in the clear. It only captures messages that arrive after infection — there is no inbox dump.

Observed exfil record → POST /api/v1/sms/report

{ "android_id": "<device ANDROID_ID>", "sender": "<originating number / shortcode>", "body": "<full message text, e.g. OTP>", "timestamp": "<receive time>" }

The implant has no disk queue and no retry, and it does not reassemble multipart SMS. In practice that means long codes split across PDUs may arrive fragmented and messages sent while the phone is offline can be lost — a genuine reliability gap that also creates the fragmented, back-to-back /sms/report POST pattern you can hunt on.

USSD Call-Forwarding Abuse

T1616 · Call Control

CallForwardManager takes an attacker-supplied number, strips every non-digit character except a leading +, and assembles a standard GSM call-forwarding USSD string. It then dials it through TelephonyManager.sendUssdRequest(), so activation happens at the carrier without a visible call.

USSD codes constructed by CallForwardManager

# enable unconditional forwarding to attacker number **21*<attacker_number># # cancel unconditional forwarding ##21#

Call-forwarding is set carrier-side. Uninstalling the app, wiping its data, or running the implant's own self_destroy command does not cancel it — the victim keeps sending calls to the attacker until someone dials ##21# or the carrier clears it. Add "check and clear conditional/unconditional forwarding" to any incident runbook for an infected handset.

Persistence & Concealment

T1541 / T1628

Corp MDM leans on ordinary Android lifecycle mechanics rather than exploits to stay resident and out of sight.

1START_STICKY service: MdmService asks Android to recreate it after the OS kills it for memory.
2Boot & replace persistence: BootReceiver relaunches the service on BOOT_COMPLETED and after the package is replaced/updated.
3Launcher hiding: MainActivity disables its own component after capturing permissions, so no icon appears in the app drawer or Recents.
4Camouflaged foreground notice: the mandatory foreground-service notification uses channel "System Service" with title "Android System" and body "System service running" to look like an OS process.

The disguise is also the detection opportunity. A user-installed app (not a system/OEM package) that shows an "Android System / System service running" foreground notification, has no launcher icon, and holds SMS + CALL_PHONE is an anomaly no legitimate app produces. MTD and MDM app-inventory rules can flag exactly that shape.

Command Loop & Capability Map

T1437.001

ApiClient registers the device, sends a heartbeat every 30 seconds and polls for commands at a nominal 10-second interval. The advertised command set is larger than what actually works — several verbs exist in the operator panel but are stubs or unimplemented in the client, consistent with the researchers' AI-assisted, buggy-build assessment.

Command	Status	Function
ping	WORKS	Returns "pong" liveness reply
forward_on	WORKS	Dials `*21<number>#` to enable forwarding
forward_off	WORKS	Dials `##21#`; clears cached state on callback
sync_sms	STUB	Reports "Sync initiated" but never reads the inbox
self_destroy	PARTIAL	Disables components, stops service, clears app data — does not uninstall
get_location	PANEL-ONLY	Exposed in panel; not implemented in client
lock_device	PANEL-ONLY	Exposed in panel; not implemented in client

Lure → sideload → resident implant → cleartext beacon → OTP/call interception feeding account takeover.

📡

05 — C2 & Operator Panel

Infrastructure

Everything runs off one hardcoded IPv4 host over plaintext HTTP on a non-standard port. That is operationally sloppy for the attacker — and a gift for defenders, because the traffic is unencrypted, uniform and easy to signature.

C2 Protocol & Endpoints

T1437.001

The manifest explicitly whitelists cleartext traffic to 69.55.61.82. All beacons hit http://69.55.61.82:3456 with a small, fixed REST surface.

Method / Endpoint	Purpose	Cadence
POST /api/v1/devices/register	Android ID, manufacturer, model, API level, device name	Once on install
POST /api/v1/devices/heartbeat	Battery status, current forwarding state	Every 30s
GET /api/v1/devices/{ANDROID_ID}/commands	Poll for queued operator commands	~Every 10s
POST /api/v1/sms/report	Exfiltrated SMS (sender, body, timestamp)	Per inbound SMS
POST /api/v1/commands/result	Command execution status back to panel	Per command

The {ANDROID_ID}-in-path command endpoint plus a 10-second poll and 30-second heartbeat produces a metronomic, low-jitter HTTP beacon to a single non-CDN IP on port 3456. That regularity is trivially detectable at the egress proxy or firewall even without decrypting anything — because there is nothing to decrypt.

Operator Panel Fingerprint

Recon pivot

The same host exposes a password-protected admin panel on port 3456. Its login page overlays a CEVA logistics background, and device/forwarding fields prefill the Armenian country code +374 — the artifact behind the tentative attribution.

🖥️

Operator panel & fake-Play screenshots

Source: Have I Been Squatted — Corp MDM teardown (view on original)

↗

Pivot hint: an internet-wide scan for HTTP services on :3456 returning the CEVA-themed login, or serving the /api/v1/devices/register route, will surface sibling C2 nodes if the operator redeploys. Watch for the same +374-defaulted panel on fresh IPs.

💥

06 — Impact & Cargo-Theft Nexus

So what

On its own, Corp MDM looks minor. In context it closes the loop on a fraud chain: phishing steals the password, the implant steals the second factor, and the account takeover turns into physical cargo theft.

🔑

OTP & MFA Defeat

Every inbound SMS — including one-time codes and password-reset links — is copied to the operator in real time, neutralising SMS-based second factors on logistics portals.

📞

Call Interception

USSD forwarding silently reroutes voice calls, defeating call-back verification and letting the operator field carrier or fraud-desk callbacks meant for the victim.

🚚

Cargo Theft & Double-Brokering

Compromised freight accounts enable shipment diversion, fraudulent re-brokering of loads and rerouting of physical cargo — the operation's end goal.

🧾

Invoice Redirection

Access to dispatch and billing portals supports business-email-compromise-style invoice fraud and payment redirection against carriers and brokers.

🕸️

07 — Wider Campaign Links

Cluster context

Corp MDM shares its C2 host with credential-phishing lures and Windows malware, and it sits alongside two documented freight-fraud clusters. The relationships are assessed as thematic overlap in tooling and targeting — not confirmed single-actor attribution.

Cluster / kit	What it is	Relationship to Corp MDM
Shared C2 (69.55.61.82)	Hosts phishing pages + Windows malware + the mobile panel	Same infrastructure — strongest direct link
Global Profit / MC Profit Always	PhaaS that harvested 1,600+ freight credentials (Sep 2025–Feb 2026)	Same sector & goal; supplies the passwords Corp MDM's OTP theft completes
Diesel Vortex	Russian-nexus cluster hitting DAT Truckstop, TIMOCOM, Teleroute, Penske	Thematic overlap (freight, cargo theft); no evidence of same operator

Do not collapse these into "one group." The honest read is a shared cybercriminal ecosystem targeting logistics: overlapping infrastructure and objectives, distinct tooling, and no proof they are the same crew. Report the C2 overlap as fact and the group linkage as hypothesis.

🧬

08 — Indicators of Compromise

IOCs

Network & delivery infrastructure

Type	Indicator	Note
C2 IP	69.55.61[.]82	Hardcoded; also hosts panel, phishing, Windows malware
C2 URL	http://69.55.61[.]82:3456	Cleartext HTTP, non-standard port
Lure domain	playgoogle.logisticstkwcargo[.]com	TKW Logistics fake Play page → /app.apk
Lure domain	playgoogle.ceva-app[.]help	CEVA Logistics fake Play page → /download/app.apk

Application & signing artifacts

Type	Value
Package name	com.corp.mdm
App label	System Service
APK SHA-256	61954bab16df91e7a1c940a2bdd5a5cf3c61b529a7c75a5ff21ac78f15c61a86
APK size	6,119,715 bytes
Signing cert	CN=Corp MDM, OU=Mobile, O=Corp, C=US (self-signed, valid 2026-06-03 – 2053)
Cert fingerprint	29f0f6c51fda728b91aaa299cf14758f01d7d83e941a549a26b8fbf2eb70fc42
Notification	Channel "System Service" · title "Android System" · body "System service running"

YARA — Corp MDM APK (signing + package + endpoints)

rule Android_CorpMDM_Implant { meta: description = "Corp MDM Android spyware (com.corp.mdm)" reference = "haveibeensquatted.com Corp MDM teardown" hash = "61954bab16df91e7a1c940a2bdd5a5cf3c61b529a7c75a5ff21ac78f15c61a86" strings: $pkg = "com.corp.mdm" ascii $cn = "CN=Corp MDM" ascii $e1 = "/api/v1/devices/register" ascii $e2 = "/api/v1/sms/report" ascii $e3 = "/api/v1/devices/heartbeat" ascii $ussd = "**21*" ascii $c2 = "69.55.61.82:3456" ascii condition: $pkg and $cn and (2 of ($e1,$e2,$e3)) and ($ussd or $c2) }

Only the C2 IP, lure domains and SMS-over-HTTP behaviour are truly durable IOCs; the APK hash and signing cert change the moment the operator rebuilds. Prioritise the network and behavioural indicators for blocking, and use the hash/cert for confirmation and retro-hunting, not as your primary control.

🔎

09 — Detection & Hunt Queries

KQL + SPL

Because the implant beacons in cleartext to a fixed IP and port, the highest-value telemetry is your egress: proxy, firewall, DNS and — where you run Defender for Endpoint on Android — device network events. Every query below is paired KQL (Microsoft Sentinel / Defender) and SPL (Splunk).

KQL — direct C2 contact (IP + non-standard port)

// Finds any device or proxy log reaching the Corp MDM C2 on :3456 union DeviceNetworkEvents, CommonSecurityLog | where RemoteIP == "69.55.61.82" or DestinationIP == "69.55.61.82" | where RemotePort == 3456 or DestinationPort == 3456 or isempty(RemotePort) | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl | sort by TimeGenerated desc

SPL — direct C2 contact

index=proxy OR index=firewall (dest_ip="69.55.61.82" OR dest="69.55.61.82") | search dest_port=3456 OR url="*69.55.61.82:3456*" | stats count min(_time) max(_time) values(url) by src_ip dest_ip dest_port

KQL — Corp MDM lure domains (DNS / proxy)

// Detects resolution or HTTP to the fake CEVA/TKW Play pages union DnsEvents, DeviceNetworkEvents, CommonSecurityLog | where RemoteUrl has_any ("playgoogle.logisticstkwcargo.com", "playgoogle.ceva-app.help") or Name has_any ("logisticstkwcargo.com", "ceva-app.help") or RequestURL has_any ("ceva-app.help", "logisticstkwcargo.com") | project TimeGenerated, DeviceName, SourceIP=Computer, RemoteUrl, Name

SPL — lure domains

index=dns OR index=proxy (query="*logisticstkwcargo.com" OR query="*ceva-app.help" OR url="*playgoogle.*") | stats count values(query) values(url) by src_ip _time | sort - _time

KQL — beacon shape (cleartext HTTP to :3456 API paths)

// Behavioural: regular POSTs to /api/v1/... over plain HTTP, non-standard port CommonSecurityLog | where RequestURL has "/api/v1/" and (RequestURL has "/sms/report" or RequestURL has "/devices/heartbeat" or RequestURL has "/devices/register") | where ApplicationProtocol == "http" or DestinationPort == 3456 | summarize hits=count(), paths=make_set(RequestURL) by SourceIP, DestinationIP, bin(TimeGenerated, 5m) | where hits > 5

SPL — beacon shape

index=proxy uri_path="/api/v1/*" (uri_path="*/sms/report" OR uri_path="*/devices/heartbeat" OR uri_path="*/devices/register") | bin _time span=5m | stats count as hits values(uri_path) as paths by src_ip dest_ip _time | where hits > 5

KQL — periodic-beacon frequency analysis (low-jitter 10–30s poll)

// Flags hosts talking to the C2 with metronomic timing typical of the poll/heartbeat loop DeviceNetworkEvents | where RemoteIP == "69.55.61.82" | sort by DeviceName, TimeGenerated asc | serialize | extend delta = datetime_diff('second', TimeGenerated, prev(TimeGenerated)) | summarize beacons=count(), avg_gap=avg(delta), stdev_gap=stdev(delta) by DeviceName | where beacons > 10 and stdev_gap < 8

SPL — beacon frequency analysis

index=firewall dest_ip="69.55.61.82" | streamstats current=f last(_time) as prev_time by src_ip | eval gap=_time-prev_time | stats count as beacons avg(gap) as avg_gap stdev(gap) as stdev_gap by src_ip | where beacons > 10 AND stdev_gap < 8

For managed Android fleets, the cleanest signal is MDM/MTD app inventory: alert on any non-store-installed package holding both READ_SMS/RECEIVE_SMS and CALL_PHONE while running a foreground service — and specifically hunt the package name com.corp.mdm and label "System Service." Pair that with the egress queries above for high-confidence confirmation.

🎯

10 — MITRE ATT&CK Mapping

Mobile matrix

Mapped to MITRE ATT&CK for Mobile. Techniques reflect the implant's observed behaviour; where a technique is inferred from delivery it is noted.

Tactic	Technique (ID)	How Corp MDM uses it
Initial Access	Phishing (T1660)	Fake CEVA/TKW Play pages lure victims to sideload
Execution	App delivered via authorized store impersonation → sideload (T1631)	User installs the counterfeit "System Service" APK
Persistence	Boot / Logon Init Execution (T1541)	`BootReceiver` + START_STICKY service restart
Defense Evasion	Hide Artifacts / Suppress App Icon (T1628.002)	`MainActivity` disables its launcher component
Defense Evasion	Masquerading (T1655)	Poses as "Android System / System service running"
Collection	Protected User Data: SMS Messages (T1636.004)	`SmsReceiver` captures inbound SMS
Impact / Collection	Call Control (T1616)	USSD-based unconditional call forwarding
Credential Access	Intercept second-factor codes via SMS (T1636.004 / MFA defeat)	OTP/reset codes forwarded to operator in real time
Command & Control	Standard Application Layer Protocol (T1437.001)	Cleartext HTTP REST to 69.55.61.82:3456
Exfiltration	Exfiltration Over C2 / Unencrypted Channel (T1646)	SMS records POSTed in plaintext

🛡️

11 — Mitigation & Hardening

Response

Block & Detect the Infrastructure

Immediate

1Blackhole 69.55.61.82 at the firewall and null-route port 3456 egress; sinkhole logisticstkwcargo.com and ceva-app.help at DNS.
2Deploy the KQL/SPL hunts above and alert on any historical hit — the cleartext beacon is retro-huntable in proxy/DNS logs.
3Add the lure apexes to brand-abuse / newly-registered-domain monitoring so redeploys are caught early.

Harden the Mobile Fleet

Policy

1Enforce "block install from unknown sources" via MDM on managed Android devices; restrict sideloading entirely for high-risk roles like dispatch and finance.
2Use Mobile Threat Defense app-inventory rules to flag non-store apps holding SMS + CALL_PHONE and running foreground services; explicitly blocklist com.corp.mdm.
3Migrate logistics-portal MFA off SMS to phishing-resistant methods (FIDO2/passkeys or authenticator push with number matching). SMS OTP is exactly what this implant defeats.

Moving even a subset of freight-portal logins to app-based or hardware MFA removes the entire value of the SMS-interception capability. Corp MDM has no fallback for a second factor it cannot read.

Incident Response for an Infected Handset

Eradication

1Dial ##21# to cancel unconditional call forwarding — remember it persists carrier-side after the app is gone.
2Manually uninstall com.corp.mdm (the launcher icon is hidden — use Settings → Apps and sort by recently installed / SMS permission).
3Reset credentials for every account whose OTPs or reset links could have transited SMS since infection, and review those accounts for takeover, invoice changes or shipment/load edits.
4Contact the mobile carrier to confirm no residual forwarding or SIM/porting changes remain.

Handset clean when

No conditional/unconditional forwarding active (verified with carrier)
com.corp.mdm removed and no foreground "System service running" notice
No further traffic to 69.55.61.82:3456 in egress logs
All SMS-OTP accounts reset and reviewed for takeover
High-risk logins migrated off SMS second factor

📚

12 — Sources & References

Primary

Have I Been Squatted — Inside Corp MDM: Android Spyware Targeting Logistics (primary teardown, Ben Folland) The Hacker News — Corp MDM Spyware Targets Logistics Firms, Steals New SMS and Redirects Calls Have I Been Squatted — Diesel Vortex: Russian Cybercrime Group Targeting US/EU Freight Triskele Labs — Diesel Vortex Phishing Campaign Targeting Freight & Logistics MITRE ATT&CK for Mobile — technique reference

◈ Check your exposure before the operator does

Corp MDM's whole model is impersonating your brand's domain to push a fake app. Run your logistics and corporate domains through the CyberHawk IOC Scanner to check the C2 and lure indicators against your environment, and track live mobile and supply-chain threats on the CyberHawk Threat Intel feed.

◈ Stay Connected

Follow CyberHawk Threat Intel for threat intelligence, deployment guides and hands-on SOC tooling content.

🌐 Website ▶️ YouTube ▶️ YouTube (2) 𝕏 Twitter / X ♪ TikTok ✈️ Telegram

🔍 IOC Scanner 🛠️ Live Tools 📚 Courses 🚨 Threat Intel 📝 Blog 📋 SOPs

"They can't exploit you if you are the Exploit."