🚨 Live Hook Android banking trojan C2 panel found with unauthenticated endpoints, an open
Socket.IO event bus, and MySQL 8.0.31 exposed directly to the internet.
🔬 Full report:
intel.breakglass.tech/post/d…
A ThreatFox-sourced IOC led us to a fully mapped Hook/ERMAC C2 panel at 31[.]57[.]216[.]126. We enumerated 24 live API endpoints across a Laravel/PHP backend, extracted the complete 35-command bot vocabulary from a 3.6MB React SPA bundle, and identified two endpoints with no authentication middleware. The
Socket.IO server on port 3434 accepted unauthenticated subscriptions to bot events, logs, and operator activity streams.
🔎 In a nutshell:
• Split architecture: nginx SPA (port 80), Laravel API (8089), Workerman WebSocket VNC relay (8000),
Socket.IO event bus (3434), MySQL (3306)
• /api/v1/smartInjections/getSessions has NO auth middleware -- would leak stolen overlay credentials if DB were functional
•
Socket.IO at port 3434 accepts arbitrary subscribe events ("bots", "logs", "all") and newBot injections without any credentials
• MySQL 8.0.31 directly internet-facing on port 3306 with caching_sha2_password -- 25,500 connection IDs indicate heavy historical use
• CORS set to Access-Control-Allow-Origin: * on all API responses -- full cross-origin attack surface
• Turkish operator indicated by language strings ("ROOT kullanici olustur"), multi-language panel supports TR/RU/EN/ZH
🧬 IOCs:
31[.]57[.]216[.]126 (Hook C2 panel)
hxxp[:]//31[.]57[.]216[.]126:8089/api/v1/sign-in
hxxp[:]//31[.]57[.]216[.]126:3434/socket.io/
#bankingTrojan #Hook #ERMAC #android #malware #threatintel #C2