Gigaset update service delivered malware

The Gigaset incident used Android maintenance software. The package com.redstone.ota.ui was a pre-installed system updater, not an app a user had chosen from a store. On affected older phones, that trusted update path reinstalled malware after users removed it.

Malwarebytes identified the updater as Android/PUP.Riskware.Autoins.Redstone and reported that it installed Android/Trojan.Downloader.Agent.WAGD payloads with package names beginning com.wagd.. Users saw browsers opening to game sites, unwanted apps returning after deletion, and messages sent through WhatsApp. Some devices also received Android/Trojan.SMS.Agent.YHN4, adding SMS abuse to the chain.

The persistence came from the supply chain position. Because the updater lived in the system image, ordinary uninstall attempts removed only the visible payloads. The same trusted maintenance component could restore them, which made the compromise feel to users like a phone that kept reinfecting itself.

Gigaset later said older GS100, GS160, GS170, GS180, GS270, GS270 plus, GS370, and GS370 plus lines were potentially affected, while newer listed models were not. The company attributed the malware installation to a compromised server belonging to an external update service provider and said the infection path was stopped on April 7, 2021.

Motive

Malware Distribution

Cause

Update Infrastructure Compromise

Transitive

No

• Pre-installed auto installer threat found on Android mobile devices in Germanymalwarebytes.com
• Another supply-chain attack? Android maker Gigaset injects malware into victims' phones via poisoned updatetheregister.com
• Gigaset Android phones infected by malware via hacked update serverbleepingcomputer.com