Yanbian Gang
- First seen
- 2013-01-01 00:00:00
- Primary motivation
- financial-gain
- Sophistication
- intermediate
- Resource level
- team
- Actor type
- criminal
- Profile updated
- 2026-07-07 11:59:46
Targeted industries: financial-services
Targeted regions: country_code:kr
Context
RiskIQ characterizes the Yanbian Gang as a group that targeted South Korean Android mobile banking customers since 2013 with malicious Android apps purporting to be from major banks, namely Shinhan Savings Bank, Saemaul Geumgo, Shinhan Finance, KB Kookmin Bank, and NH Savings Bank.
Reports & references
- riskiq.com — Yanbian Gang Malware Distribution (report)
- Trend Micro — A Look Into The Connection Between Xloader And Fakespy And Their Possible Ties With The Yanbian Gang (report)
- Trend Micro — Xloader Android Spyware And Banking Trojan Distributed Via Dns Spoofing (report)
- Trend Micro — Fakespy Android Information Stealing Malware Targets Japanese And Korean Speaking Users (report)
- Trend Micro — Mobile Malware Gang Steals Millions From South Korean Users (report)