{
  "family": "lotoor",
  "sample_count": 6,
  "category": "trojan",
  "description": "Exploit:AndroidOS/Lotoor (often referred to simply as Lotoor) is a specific classification for a family of **Android Rooting Exploits**. Unlike traditional malware that runs within the confines of the Android sandbox, Lotoor's sole objective is to actively exploit vulnerabilities in the Linux kernel underlying the Android OS to escalate its privileges to `root` (superuser). Once root access is achieved, the malware can bypass all Android security models to install persistent backdoors or aggressive adware.<br><br><b>Understanding Android Rooting Malware</b><br>To an end-user, the infection vector is usually a deceptive app downloaded from a third-party marketplace. For a Mobile Device Management (MDM) administrator, Lotoor represents a complete device compromise. By achieving root, the malware can install itself in the `/system` partition, meaning it survives factory resets, rendering standard removal techniques useless.<br><br><b>Execution and Exploitation Mechanics</b><br>Lotoor is typically bundled inside Trojanized applications disguised as games or utilities (`T1444`). Upon installation and execution (`T1627`), it profiles the device's specific Android version, kernel build, and hardware architecture (`T1426`). It then selects and deploys a specific privilege escalation exploit tailored to that environment (historically, exploits like 'Towelroot' or 'Framaroot') (`T1404`). If successful, it mounts the read-only `/system` partition as read-write, drops an `su` binary, and installs its secondary payload (often a persistent backdoor or un-removable adware) directly into the system directories (`T1543`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the complete compromise of the mobile device's integrity and the potential theft of corporate data if the device is used for BYOD. MDM logs will flag the device as 'Rooted' or 'Compromised'. The user may notice the sudden appearance of new, uninstallable applications (bloatware) or highly aggressive, full-screen advertisements appearing even when the browser is closed. The device may also become highly unstable and prone to crashing due to the kernel exploitation.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1444",
    "T1404",
    "T1543",
    "T1426"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1404",
      "name": "Exploitation for Privilege Escalation (Exploiting the Android/Linux kernel)",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1543",
      "name": "Create or Modify System Process (Installing payloads in /system)",
      "tactic": "Persistence"
    },
    {
      "id": "T1444",
      "name": "Drive-by Compromise (Malicious third-party app stores)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1426",
      "name": "System Information Discovery (Profiling kernel versions for exploits)",
      "tactic": "Discovery"
    }
  ],
  "containment_steps": [
    "Use the corporate MDM (Mobile Device Management) solution to immediately quarantine the device, wiping all corporate data and cutting VPN/email access.",
    "A standard Android 'Factory Reset' via the settings menu is often insufficient to remove Lotoor, as it resides in the `/system` partition.",
    "The device must be completely 'flashed' with a clean, factory-verified ROM image from the manufacturer to ensure the malware is eradicated.",
    "Enforce MDM policies that strictly prohibit the installation of applications from 'Unknown Sources' (third-party app stores)."
  ],
  "what_to_avoid": [
    "Do not allow the device to connect to the corporate network once it has been flagged as rooted.",
    "Avoid assuming an antivirus app from the Google Play Store can remove it; AV apps do not have the root privileges necessary to clean the `/system` partition."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}