Octagon Android Banking Botnet + PurpleDelta DPRK Insider Fraud: OTX Pulse Analysis — Mobile MaaS & Identity Deception Detection Pack

Threat Summary

Two converging financially motivated threat clusters dominate this cycle of OTX reporting, and both attack the same surface from opposite directions: trust in financial transactions and trust in workforce identity.

Octagon is a previously undocumented Android fraud bot first identified in June 2026, sold as malware-as-a-service (MaaS) by the Russian-speaking actor AndroidKitKat for $1,400 per month. Its kill chain is built on Android accessibility service abuse: once a victim sideloads the trojanized application, Octagon requests accessibility permissions, then layers overlay attacks on top of legitimate banking and cryptocurrency wallet applications. Hidden VNC gives operators real-time remote control of the device, SMS interception defeats OTP-based transaction signing, unlock-pattern capture defeats device lockout, and automated balance reading lets operators prioritize high-value victims before draining accounts. The target set is explicit: cryptocurrency wallets, exchanges, and banking applications — the finance sector.

PurpleDelta is the Recorded Future designation for multiple clusters of North Korean IT workers who applied to more than 1,100 companies between late 2024 and early 2025, hitting software, technology, staffing, consulting, healthcare, finance, media, and NGO verticals. Operators maintained at least 22 fabricated personas supported by AI-generated profile photos, custom ChatGPT assistants for interview and task support, and fraudulent identity documents. This is not a smash-and-grab operation — it is a revenue-generation and pre-positioning campaign that converts fraudulent employment into salary theft, intellectual property access, and potential insider-stage intrusion capability for the DPRK regime.

Read together, these pulses describe a maturing criminal and state-aligned economy: commodity mobile fraud tooling rented by subscription on the dark side, and nation-state labor infiltration laundering itself through legitimate hiring pipelines. Enterprises holding financial assets or employing remote technical staff are in scope for both.

Threat Actor / Malware Profile

Octagon (AndroidKitKat) — Android Fraud MaaS

• Distribution: Sold via Russian-speaking underground channels at $1,400/month. Delivered to victims through sideloaded APKs masquerading as legitimate finance, utility, or update applications (MaaS operators typically pair it with phishing SMS and dropper sites).
• Payload behavior: Accessibility overlay injection over banking and crypto wallet apps to harvest credentials; hidden VNC module streaming device screens to operators; SMS interception for OTP/2FA capture; unlock-pattern logging via accessibility event scraping; automated balance enumeration across wallet and banking apps for victim triage.
• C2 communication: Operator infrastructure identified at 45.192.12.34 and 209.99.184.50/28 block addresses. Traffic typically rides HTTPS to blend with legitimate mobile API calls, with VNC sessions tunneled over persistent outbound connections.
• Persistence mechanism: Accessibility service registration survives reboots; abuse of Android battery-optimization exemptions and device admin / accessibility auto-relaunch keeps the implant resident without rooting the device.
• Anti-analysis: Overlay logic only triggers against a hardcoded target package list (wallets/exchanges/banks), keeping the sample dormant in sandboxes; MaaS builder produces per-customer builds, which is consistent with the five distinct MD5 sample hashes in the pulse.

PurpleDelta — DPRK Fraudulent Employment Clusters

• Distribution / entry vector: Legitimate hiring funnels — job boards, staffing agencies, freelance platforms — using fabricated personas at scale (22+ confirmed, 1,100+ companies targeted).
• Persona tooling: AI-generated profile photography, custom ChatGPT assistants for live interview answers and day-to-day task completion, forged identity documents, and U.S.-based laptop-farm / proxy infrastructure to geolocate as domestic workers.
• Infrastructure: Concentrated IPv4 blocks under 104.253.0.0/16 (VPN/proxy exit nodes used to mask true operator location) plus 218.24.120.118 (China Unicom Liaoning space — consistent with known DPRK IT worker egress patterns via northeast China).
• Objective: Salary exfiltration to the DPRK regime, sustained access to corporate codebases and SaaS environments, and optionality for follow-on intrusion or extortion from insider position.

IOC Analysis

The pulses carry two indicator classes, and they must be operationalized differently:

• IPv4 indicators (11 total): The Octagon set (45.192.12.34, 209.99.184.50, 209.99.187.28) represents live MaaS C2/VNC infrastructure — these are high-confidence block candidates at the perimeter and on any corporate-owned mobile device management egress. The PurpleDelta set is dominated by the 104.253.0.0/16 range: these are proxy/VPN exit nodes, so treat them as authentication-context indicators, not raw blocks. Alert on corporate SaaS and VPN logins sourced from these addresses rather than null-routing the range, since proxy IPs generate false positives if blocked blindly. 218.24.120.118 should be alerted on for any corporate resource access — there is no legitimate business reason for most Western enterprises to see authentication from that space.
• FileHash-MD5 indicators (5 total): Octagon sample hashes. MD5s are brittle against MaaS per-customer builds, so use them for retro-hunt matching against EDR file inventories, mobile threat defense (MTD) telemetry, and any APK that has transited corporate email or MDM sideload channels — not as forward-looking block logic.
• No domains or URLs appear in the IOC samples; detection weight therefore falls on network-destination behavior and endpoint behavioral analytics rather than DNS filtering.

SOC operationalization: push the Octagon IPs into firewall, EDR network blocklists, and MTD policy; load the PurpleDelta IPs into your identity provider's risk engine (Entra ID Conditional Access, Okta network zones) as high-risk sign-in sources; match MD5s in CrowdStrike/Defender/SentinelOne retro-hunts. Tools that decode and pivot on these indicator types: MISP for structured IOC management, AbuseIPDB/ipinfo for ASN enrichment on the 104.253 range, and VirusTotal/OTX pulses for hash reputation expansion.

Detection Engineering

---
title: Octagon Android Bot C2 and VNC Infrastructure Communication
id: 8f3a1c2e-7b4d-4e6a-9c1f-2d5b8a0e3f71
status: experimental
description: Detects outbound network connections from corporate-managed devices to known Octagon Android MaaS C2 and hidden-VNC infrastructure attributed to AndroidKitKat.
references:
  - https://iverify.io/blog/octagon-android-bot-crypto-wallets-banking-apps
author: Security Arsenal Threat Intelligence
date: 2026/08/19
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.t1219
logsource:
  category: network_connection
  product: zeek
detection:
  selection_ip:
    DestinationIp|contains:
      - '45.192.12.34'
      - '209.99.184.50'
      - '209.99.187.28'
  condition: selection_ip
falsepositives:
  - None expected; these addresses are dedicated MaaS operator infrastructure
level: high
---
title: Authentication From PurpleDelta DPRK IT Worker Proxy Infrastructure
id: 4d9e7a1b-3c8f-4a2d-b5e6-1f0c9d7e2a83
status: experimental
description: Detects successful or attempted authentication to corporate identity platforms from IP ranges associated with PurpleDelta North Korean fraudulent IT worker operations, including laptop-farm proxy egress and China Unicom Liaoning space.
references:
  - https://www.recordedfuture.com/research/purpledelta-fraudulent-employment-operations
author: Security Arsenal Threat Intelligence
date: 2026/08/19
tags:
  - attack.initial_access
  - attack.t1078
  - attack.t1133
logsource:
  category: authentication
  product: azure
  service: signinlogs
detection:
  selection_subnet:
    IPAddress|cidr:
      - '104.253.0.0/16'
  selection_single:
    IPAddress:
      - '218.24.120.118'
  condition: selection_subnet or selection_single
falsepositives:
  - Legitimate users on consumer VPN services sharing proxy egress; validate against HR-verified employee location and device enrollment before actioning account disable
level: high
---
title: Mobile Device Accessibility Overlay and Credential Theft Behavior
id: 7b2c5f8d-1a9e-4d3c-8f6b-4e2a0c1d9f55
status: experimental
description: Detects endpoint and MTD telemetry patterns consistent with Android accessibility-service overlay attacks, SMS interception, and credential capture against financial applications as implemented by the Octagon fraud bot.
author: Security Arsenal Threat Intelligence
date: 2026/08/19
tags:
  - attack.credential_access
  - attack.t1417
  - attack.t1517
  - attack.t1636
logsource:
  product: android
  category: application
  service: mtd
detection:
  selection_behavior:
    EventType|contains:
      - 'accessibility_service_enabled_unknown_source'
      - 'overlay_window_over_finance_app'
      - 'sms_read_permission_sideloaded_apk'
      - 'screen_capture_or_vnc_session'
  selection_target:
    TargetPackage|contains:
      - 'wallet'
      - 'bank'
      - 'exchange'
      - 'coinbase'
      - 'binance'
  condition: selection_behavior and selection_target
falsepositives:
  - Legitimate password managers and accessibility tools; restrict alerting to sideloaded packages not signed by known enterprise or Play Store certificates
level: critical

let OctagonC2 = dynamic(["45.192.12.34", "209.99.184.50", "209.99.187.28"]);
let PurpleDeltaInfra = dynamic(["104.253.147.147", "104.253.51.76", "104.253.72.75", "104.253.134.123", "218.24.120.118", "104.253.1.79", "104.253.103.238", "104.253.111.106"]);
let OctagonHashes = dynamic(["3530b1600e059468e585d48482bb2f37", "41d922a220ac28a4af8cbed3ffff517b", "471bcf065c6ed44282c5776ee78bc6d0", "b7e9072e5bda17e0c68db01010658481", "d472e984c6e8f3d4d7352125ebcc7c3c"]);
union isfuzzy=true
    (DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where RemoteIP in~ (OctagonC2)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, ActionType, DetectionSource = "Octagon C2/VNC"),
    (DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where RemoteIP in~ (PurpleDeltaInfra) or RemoteIP startswith "104.253."
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, ActionType, DetectionSource = "PurpleDelta Proxy Egress"),
    (DeviceFileEvents
    | where TimeGenerated > ago(30d)
    | where MD5 in~ (OctagonHashes)
    | project TimeGenerated, DeviceName, FileName, FolderPath, MD5, SHA256, DetectionSource = "Octagon Sample Hash")
| sort by TimeGenerated desc

# Security Arsenal - Octagon / PurpleDelta IOC Hunt Script
# Run on Windows endpoints and VDI/laptop-farm candidate systems.

$OctagonC2 = @('45.192.12.34','209.99.184.50','209.99.187.28')
$PurpleDeltaIPs = @('104.253.147.147','104.253.51.76','104.253.72.75','104.253.134.123','218.24.120.118','104.253.1.79','104.253.103.238','104.253.111.106')
$OctagonMD5 = @('3530b1600e059468e585d48482bb2f37','41d922a220ac28a4af8cbed3ffff517b','471bcf065c6ed44282c5776ee78bc6d0','b7e9072e5bda17e0c68db01010658481','d472e984c6e8f3d4d7352125ebcc7c3c')

Write-Host "[*] Checking active and historical network connections to threat infrastructure..."
$conns = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object {
    $OctagonC2 -contains $_.RemoteAddress -or $PurpleDeltaIPs -contains $_.RemoteAddress -or $_.RemoteAddress -like '104.253.*'
}
if ($conns) {
    $conns | ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        Write-Host "[ALERT] Connection to $($_.RemoteAddress):$($_.RemotePort) by $($proc.ProcessName) (PID $($_.OwningProcess))" -ForegroundColor Red
    }
} else { Write-Host "[OK] No live connections to listed IOC IPs." }

Write-Host "[*] Reviewing DNS client cache for resolutions matching PurpleDelta proxy range..."
Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $_.Data -like '104.253.*' -or $PurpleDeltaIPs -contains $_.Data } |
    ForEach-Object { Write-Host "[ALERT] DNS cache: $($_.Entry) -> $($_.Data)" -ForegroundColor Red }

Write-Host "[*] Hunting Octagon sample hashes in common staging paths..."
$paths = @("$env:TEMP", "$env:APPDATA", "$env:USERPROFILE\Downloads", "C:\ProgramData")
foreach ($p in $paths) {
    Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        try {
            $h = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction Stop).Hash.ToLower()
            if ($OctagonMD5 -contains $h) {
                Write-Host "[ALERT] Octagon hash match: $($_.FullName) (MD5 $h)" -ForegroundColor Red
            }
        } catch {}
    }
}

Write-Host "[*] Checking for suspicious remote-access persistence (PurpleDelta laptop-farm pattern)..."
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
    $_.TaskName -match 'screen|connect|remote|rust|anydesk|teamviewer|splashtop' -and $_.TaskPath -notmatch 'Microsoft'
} | ForEach-Object { Write-Host "[REVIEW] Suspicious scheduled task: $($_.TaskPath)$($_.TaskName)" -ForegroundColor Yellow }

Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -ErrorAction SilentlyContinue |
    Out-String | Select-String -Pattern 'anydesk|teamviewer|rustdesk|splashtop|screenconnect' |
    ForEach-Object { Write-Host "[REVIEW] Run-key remote tool persistence: $($_.Line.Trim())" -ForegroundColor Yellow }

Write-Host "[*] Checking RDP logon history for proxy-range sources..."
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} -MaxEvents 5000 -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match '104\.253\.' -or $_.Message -match '218\.24\.120\.118' } |
    Select-Object -First 20 | ForEach-Object { Write-Host "[ALERT] Logon from PurpleDelta infrastructure at $($_.TimeCreated)" -ForegroundColor Red }

Write-Host "[*] Hunt complete."

Response Priorities

Immediate (0-4 hours)

• Block Octagon C2/VNC IPs (45.192.12.34, 209.99.184.50, 209.99.187.28) at the perimeter firewall, DNS sinkhole, and any corporate mobile/MDM egress path.
• Load the five Octagon MD5s into EDR block/watch lists and run a fleet-wide retro-hunt; query MTD vendors for sideloaded APK telemetry on corporate-enrolled Android devices.
• Feed the PurpleDelta IP set into your IdP risk engine as high-risk sign-in sources; trigger step-up MFA or session revocation for any account that has authenticated from 104.253.0.0/16 or 218.24.120.118.
• Audit crypto-treasury and corporate banking workflows for transactions initiated from mobile devices in the last 30 days.

24 Hours

• Because Octagon steals session credentials, unlock patterns, and OTPs: force credential resets and token revocation for any user whose device touched Octagon infrastructure, and re-baseline MFA enrollment on those accounts.
• Cross-reference the last 18 months of hires against PurpleDelta indicators: verify identity documents, require live on-camera verification for remote technical staff, and flag employees whose corporate laptop traffic consistently egresses via commercial VPN/proxy ranges.
• Review OAuth grants and API keys created by any account with a PurpleDelta-range sign-in; rotate exposed secrets.

1 Week

• Harden mobile architecture: enforce MTD on all devices accessing financial SaaS, block sideloading via MDM policy, and restrict accessibility-service permissions to an allowlist.
• Implement hardware-bound phishing-resistant MFA (FIDO2/passkeys) for finance and engineering roles — this blunts both Octagon OTP interception and PurpleDelta remote-account abuse.
• Formalize an insider-fraud hiring control: E-Verify/document forensics for remote hires, geolocation attestation of work devices, and conditional access policies denying authentication from known proxy/VPN ASN space for privileged roles.
• Deploy the Sigma and KQL detections above into production and validate with purple-team replay of overlay and proxy-login scenarios.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub