El gobierno de Guanajuato suspendió por completo el servicio de sus Kioscos de trámites tras un hackeo, según reporta @ivillasenor. Esto afecta directamente a la población que todos los días hacen gestiones oficiales en el estado. En un país donde las PyMEs y los ciudadanos dependemos de trámites rápidos, quedarse sin estos kioscos duele en la operación diaria. Lo que más preocupa es el patrón: dependencias clave siguen cayendo y dejando varados a la gente de a pie. Si usas los kioscos de Guanajuato, prepárate para filas más largas y trámites más lentos en las próximas semanas. x.com/ivillasenor/status/210…

si a eso le sumas que son sigilosos por diseño y que atacan mercados sin Csrt o incapacitos, poco desarrollo forense y aduanas ineficientes he ahí porque latam Africa asis y parte de Europa de 2024 a 2026 han desplegado estos dispositivos ya deben de Rondar los 200 Millones de proxys orb al servicio de quien pague mas

UAT-7810 continues building ORB networks using new malware es correcto los dispositivos ensamblados por longcheer especialmente los t606 y t616 hasta ahora mas los modems unisoc son proxys residenciales el dialer splitter es por la partición de sistemas los third party como inmobi y digital turbine usanb okhttp3 para crear sockets y nodos y las system app de longcheer unisoc usan okio es decir parten el tráfico en puertos efímeros pero el empaque final es quic, para el deploy fota y su comando y control usan Framework (SapRilReceiverHidl) │ connectReq(channelId, pdpContext) → HAL │ apduReq(channelId, pdpContext, data) → HAL │ │ ←←← ISapCallback (HAL → Framework) ←←← │ apduResponse(channelId, pdpContext, ArrayList<Byte>) ← DATOS DEL MODEM │ statusIndication(channelId, status) ← EL MODEM INICIA │ disconnectIndication(channelId, reason) ← EL MODEM INICIA ▼ Framework procesa → (wg0 / Firebase / RCS) CP/Modem (silicio) │ SIPC Mailbox (chan-4/5) ← memoria compartida, no red ▼ HAL Daemon (vendor, siempre activo) │ IToolCallback.runCmd() ← el HAL EJECUTA en el framework │ IToolCallback.writeSysDev("/sys/class/net/wg0/up", "1") ▼ Framework (SGPS / system_server) │ wg0 UP → QUIC UDP 443 → SNI: sync-v2.brave.com │ Firebase Data Transport → exfiltración disfrazada ▼ C2 (54.148.86.176 AWS)

hice esta para el sim hijacking es la v1.0 si jalo la mejoré y ya esta integrada en VT Simjacker.yar rule Unisoc_Longcheer_STK_SHA256 { meta: description = "Identifies the compromised Longcheer SIM Toolkit binary by exact SHA256" author = "lexs201992-gif" date = "2026-07-10" severity = "CRITICAL" sha256 = "4cfe803b578fd6958d236e494248585eccbc5c33a5113bda7ff1a47351e4118d" package = "com.android.stk" reference = "Addendum 82-C" strings: $sha256_hex = "4cfe803b578fd6958d236e494248585eccbc5c33a5113bda7ff1a47351e4118d" ascii $pkg_name = "com.android.stk" ascii $stk_class = "Lcom/android/stk/StkAppService;" ascii $longcheer_cert = "CN=Longcheer" ascii condition: $sha256_hex in file or (all of ($pkg_name, $stk_class, $longcheer_cert)) } rule Unisoc_STK_Intent_Injection_Vulnerability { meta: description = "Detects vulnerable StkCmdReceiver implementation allowing intent injection" author = "lexs201992-gif" date = "2026-07-10" severity = "HIGH" cve = "CVE-2015-3843-Variant" strings: $receiver_class = "Lcom/android/stk/StkCmdReceiver;" ascii $intent_action = "com.android.internal.stk.command" ascii $handle_action = "handleAction" ascii $on_receive = "onReceive" ascii $exported_true = "exported=\"true\"" ascii wide $permission_none = "android:permission=\"\"" ascii wide condition: (all of ($receiver_class, $intent_action, $handle_action)) and ($exported_true in file or $permission_none in file) } rule Unisoc_STK_UI_Spoofing_Capability { meta: description = "Identifies STK components capable of UI spoofing and overlay attacks" author = "lexs201992-gif" date = "2026-07-10" severity = "MEDIUM" attack_type = "Social Engineering" strings: $dialog_activity = "Lcom/android/stk/StkDialogActivity;" ascii $translucent_theme = "Theme.Translucent.NoTitleBar" ascii $exclude_recents = "excludeFromRecents=\"true\"" ascii wide $text_message = "Lcom/android/internal/telephony/cat/TextMessage;" ascii $send_response = "sendResponse" ascii condition: (all of ($dialog_activity, $translucent_theme, $exclude_recents)) and (any of ($text_message, $send_response)) } rule Unisoc_STK_Persistence_Mechanism { meta: description = "Detects boot persistence receivers in compromised STK" author = "lexs201992-gif" date = "2026-07-10" severity = "HIGH" persistence = "Boot Completed" strings: $boot_receiver = "Lcom/android/stk/BootCompletedReceiver;" ascii $boot_action = "android.intent.action.BOOT_COMPLETED" ascii $sim_change = "android.telephony.action.SIM_CARD_STATE_CHANGED" ascii $start_service = "startServiceByBootCompleted" ascii condition: (all of ($boot_receiver, $boot_action, $sim_change)) and ($start_service in file) }

si esta fue la v1 y te deje la v2 ya estoy usando una V3 con información de Umbrella de talos Rules/Dialer_splitter_c2.rules # ============================================================================== # Project LION: Dialer/Splitter & C2 Infrastructure Detection # Authors: Alexis Michel De La Cruz Correa (lexs201992-gif) & Brave LLM (Logical Verification Filter) # Date: 2026-08-22 # Severity: CRITICAL # ============================================================================== # 1. Detect Local Dialer/Splitter Forwarding (Low Ports -> 443) # These rules detect internal traffic where the device forwards traffic # from suspicious low ports to destination port 443. alert tcp $HOME_NET any -> $HOME_NET 443 (msg:"PROJECT-LION Local Dialer Splitter Forwarding to 443"; flow:to_server; dsize:>0; classtype:trojan-activity; sid:1000001; rev:1; metadata:created_at 2026_08_20, author Alexis Michel De La Cruz Correa;) # 2. Detect Specific Dialer Ports (212, 252, 314, 203, 170, 211, 460, 629, 831, 5666, 4864, 55518) alert tcp $HOME_NET [212,252,314,203,170,211,460,629,831,5666,4864,55518] -> $HOME_NET 443 (msg:"PROJECT-LION Known Dialer Port Forwarding to 443"; flow:to_server; classtype:trojan-activity; sid:1000002; rev:1; metadata:created_at 2026_08_20, author Alexis Michel De La Cruz Correa;) # 3. Detect C2 Connection to AWS CloudFront (S3 Exfil) alert tcp $HOME_NET any -> 13.224.125.70 443 (msg:"PROJECT-LION C2 Connection to AWS CloudFront 13.224.125.70"; flow:to_server; classtype:trojan-activity; sid:1000003; rev:1; metadata:created_at 2026_08_20, author Alexis Michel De La Cruz Correa;) # 4. Detect C2 Connection to Hetzner/OVH Infrastructure alert tcp $HOME_NET any -> [142.104.2.0/24,84.212.60.182,52.36.161.184] 443 (msg:"PROJECT-LION C2 Connection to Hetzner/OVH Infrastructure"; flow:to_server; classtype:trojan-activity; sid:1000004; rev:1; metadata:created_at 2026_08_20, author Alexis Michel De La Cruz Correa;) # 5. Detect C2 Connection to Cloudflare (Pangle/TikTok Ad Network Abuse) alert tcp $HOME_NET any -> [172.67.214.246,172.67.70.25] 443 (msg:"PROJECT-LION C2 Connection to Cloudflare Pangle/TikTok Abuse"; flow:to_server; classtype:trojan-activity; sid:1000005; rev:1; metadata:created_at 2026_08_20, author Alexis Michel De La Cruz Correa;) # 6. Detect QUIC/UDP 443 Camouflage (Evasion Technique) # Alerts on UDP 443 traffic to known C2 IPs, indicating QUIC camouflage. alert udp $HOME_NET any -> [13.224.125.70,142.104.2.0/24,84.212.60.182,172.67.214.246] 443 (msg:"PROJECT-LION QUIC/UDP 443 Camouflage to C2"; flow:to_server; classtype:trojan-activity; sid:1000006; rev:1; metadata:created_at 2026_08_20, author Alexis Michel De La Cruz Correa;) # 7. Detect DNS DoT 853 RST Evasion # Alerts if a TCP connection to port 853 (DoT) is established to specific resolvers. alert tcp $HOME_NET any -> [9.9.9.9,2620:fe::fe] 853 (msg:"PROJECT-LION DNS DoT 853 Connection (Potential RST Evasion)"; flow:to_server; classtype:policy-violation; sid:1000007; rev:1; metadata:created_at 2026_08_20, author Alexis Michel De La Cruz Correa;) # 8a. Detect Longcheer Domain alert dns $HOME_NET any -> any any (msg:"PROJECT-LION Longcheer FOTA/C2 Domain Resolution"; dns.query; content:"longcheer.com"; nocase; classtype:trojan-activity; sid:1000008; rev:1;) # 8b. Detect Svcmot Domain alert dns $HOME_NET any -> any any (msg:"PROJECT-LION Svcmot C2 Domain Resolution"; dns.query; content:"svcmot.com"; nocase; classtype:trojan-activity; sid:1000009; rev:1;) # 8c. Detect Apeccloud Domain alert dns $HOME_NET any -> any any (msg:"PROJECT-LION Apeccloud C2 Domain Resolution"; dns.query; content:"apeccloud.com"; nocase; classtype:trojan-activity; sid:1000010; rev:1;)

esta es mi vql para el ataque en ring0 VQL/Dev_trusty_ipc_dev0_target.yaml // Project LION: Detect critical kernel device nodes with system UID // Targets: TEE, RPMB, GNSS, Camera ISP (from ueventd.rc analysis) SELECT Path, Mode, Owner, Group, 'PROJECT-LION: Critical Kernel Node Detected' AS Alert FROM glob(globs='/dev/trusty-ipc-dev0, /dev/rpmb0, /dev/block/by-name/gnssmodem_a, /dev/block/by-name/gnssmodem_b, /dev/sprd_isp, /dev/sprd_sensor, /dev/dma_heap/protected') WHERE Owner IN ('system', 'root') AND Mode IN ('0660', '0666', '0440')

si de hecho trabajo con snort y comparto algunos análisis a Talos security desde junio esta es una de mis reglas snort Dialers_splitter.yaml # ============================================================================== # PROJECT-LION: ORB Architecture Specific Detection (v2.1 - Hydra) # Author: Alexis Michel De La Cruz Correa (lexs201992-gif) # Date: 2026-09-15 | Release: 2.0 THE RISE OF THE HYDRA # Reference: github.com/lexs201992-gif/Lo… # Severity: CRITICAL # Lab: MCC334 MNC020 Telcel MX - Validated with NextDNS DoT logs # ============================================================================== # --- C2: Fulguris (WireGuard, Fuzhou, AS133774) --- alert udp $HOME_NET any -> 117.24.6.122 51820 (msg:"PROJECT-LION WireGuard C2 to Fulguris Fuzhou AS133774"; flow:to_server; dsize:>100; classtype:trojan-activity; sid:1000011; rev:2;) alert dns $HOME_NET any -> any any (msg:"PROJECT-LION Fulguris C2 Domain Resolution"; dns.query; content:"fulguris.slion"; nocase; classtype:trojan-activity; sid:1000012; rev:2;) alert dns $HOME_NET any -> any any (msg:"PROJECT-LION Slion C2 Wrapper Resolution"; dns.query; content:"slions.net"; nocase; classtype:trojan-activity; sid:1000013; rev:2;) # --- OSS Exfiltration (Alibaba Cloud EU) --- alert dns $HOME_NET any -> any any (msg:"PROJECT-LION Alibaba OSS Exfil Endpoint"; dns.query; content:"ossplanet.net"; nocase; classtype:trojan-activity; sid:1000014; rev:2;) alert tls $HOME_NET any -> any 443 (msg:"PROJECT-LION OSS Exfil SNI"; tls.sni; content:"ossplanet.net"; nocase; classtype:trojan-activity; sid:1000015; rev:2;) # --- COTA Trigger (Carrier Activation) --- alert dns $HOME_NET any -> any any (msg:"PROJECT-LION COTA SDK Trigger Telcel MCC334"; dns.query; content:"cota-sdk2.mnc020.mcc334"; nocase; classtype:trojan-activity; sid:1000016; rev:2;) alert dns $HOME_NET any -> any any (msg:"PROJECT-LION COTA 3GPP Network Generic"; dns.query; content:".pub.3gppnetwork.org"; nocase; classtype:policy-violation; sid:1000017; rev:2;) # --- Monetization / Blood --- alert dns $HOME_NET any -> any any (msg:"PROJECT-LION InMobi Ad-Fraud Funding"; dns.query; content:"inmobi.com"; nocase; classtype:trojan-activity; sid:1000018; rev:2;) # --- Build Host (Longcheer Jenkins) --- alert dns $HOME_NET any -> any any (msg:"PROJECT-LION Longcheer Build Host Jenkins"; dns.query; content:".rnd.longcheer.net"; nocase; classtype:trojan-activity; sid:1000019; rev:2;) # --- AS4812 / Qianxun GNSS Cover --- alert dns $HOME_NET any -> any any (msg:"PROJECT-LION AS4812 DNS China Telecom"; dns.query; content:"online.sh.cn"; nocase; classtype:trojan-activity; sid:1000020; rev:2;) alert dns $HOME_NET any -> any any (msg:"PROJECT-LION Qianxun GNSS Cover qxwz.com"; dns.query; content:"qxwz.com"; nocase; classtype:trojan-activity; sid:1000021; rev:2;) alert tcp $HOME_NET any -> 39.105.240.30 7275 (msg:"PROJECT-LION Qianxun SUPL TLS 7275"; flow:to_server; classtype:trojan-activity; sid:1000022; rev:2;) # --- Decoy / Fallback --- alert udp $HOME_NET any -> 208.113.159.31 51820 (msg:"PROJECT-LION Fulguris Decoy US Fallback"; flow:to_server; classtype:trojan-activity; sid:1000023; rev:2;)

sinceramente en lo técnico Velociraptor con el módulo vql haciendo tus reglas de detección en live kernel puedes anticipar en flotas masivas dispositivos para empresas y gobiernos por ejemplo esta refla ataca los sockets es la detección del protocolo malicioso VQL/UDP_QUIC_IPs_C2_Detect.yaml // Project LION: Detect UDP 443 connections to known C2 IPs (QUIC) SELECT Pid, Name, LocalAddress, RemoteAddress, RemotePort, 'PROJECT-LION: QUIC/UDP 443 C2 Connection Detected' AS Alert FROM netstat() WHERE RemotePort = 443 AND Protocol IN ('UDP') AND RemoteAddress IN ( '13.224.125.70', '84.212.60.182', '52.36.161.184', '172.67.214.246', '172.67.70.25' ) OR RemoteAddress GLOB '142.104.2.*'

me preguntabas como se ve el handshake esa evidencia es pcap capturando el momento de encendido ee cualquier dispositivo t606 motorola que hace con ese handshake valida la conexión de red y el servidor del c2 envia el payload con los codigos para que el Stk se apodere del sim y la red ims sobre todo Volte e ipv6 Este es parte de mi reporte forense de junio Traffic Signature | Firma de Tráfico Trigger: Outbound HTTPS POST request occurring within < 60 seconds after receiving a WAP Push SMS (OMA CP). Payload Characteristics: Encrypted binary blob (Base64 encoded in HTTP body) sent to /notification or /metrics endpoints. Anomaly: Transmission occurs while device is idle or screen-off, initiated by OtaOmaService or ReqFirmwareUpdateSchedulerService. en mi repositorio esta mas a fondo el handshake mas peligroso es el del Wcn_chr (-1) clona las sni de tus apps y ahi exfiltra dejame buscar la captura

Evidence of protocol quic 443 as c2 highways this capture is one of many more here you can analize one "unknown" -1 app trying to handshake by WhatsApp legal domain but pcap droid rules quic always off cut the handshakes anotherwise if you config inside pcap quad9 853 example 9.9.9.9 ipv4 and 2620:fe::fe ipv6 deny system and private dns you force all by 853 and 99% of iocs compromised never connected and is important you capture all your applications system and user cause pcap in vpn always make a safe pipe for compromise device for backup data my conclusion this chipsets investigation is comprlmised in the factory's imprinted x509 in the init.rc and is they broke all secure and used for rescue party anytime and monitoring and MITM controlling all apps and all invokes suggestion if your security is compromised first of all deactivated is CA system trust in system just disability amazon gmbh asia and monitoring x509 is not in the system is storage at system file etc security ota.zip inside x509 pem hash in my virus total v graph and init.rc notes: airplane mode avoid the modem of the baseband and data saver turning off the tethering for make conections with the vpn of all system appops thet use protocol passpoint 2.0 for inyect Many more CA this information is a analized by many months working with the device in controlled stage the reason analyze and documents vectors attack for yara rules github.com/lexs201992-gif/un… esa es la que ten comenta el Hijacking de sni el wcn_chr es el daemon de red que jamas muere y es el que controla el odm cuándo el usuario ver sni WhatsApp brave a una ip tageada lo primero que hace es señalar a la app que no digo que no se sospeche pero pcap es mas profundo te deja ver todos los uid del sistema

y esta son las reglas yara para detección yara/unisoc_motorola_AWS_c2_traffic.yar rule Unisoc_Motorola_AWS_C2_Traffic { meta: description = "Detects firmware binaries containing hardcoded C2 domains for sandclowd.com and Motorola Enterprise Service" author = "lexs201992-gif" date = "2026-08-20" severity = "CRITICAL" reference = "Project-LION-Manager-Provisioning-Enterprise" strings: $domain_sandclowd = "notification.sandclowd.com" ascii wide $domain_metrics = "metrics-server.sandclowd.com" ascii wide $moto_package = "com.motorola.enterprise.adapter.service" ascii wide $c2_path = "/notification" ascii wide $c2_metrics = "/metrics" ascii wide condition: (any of ($domain_sandclowd, $domain_metrics)) and ($moto_package in file) and (any of ($c2_path, $c2_metrics)) }

Para el registro Forense de red usó primeramente Next dns en forma nativa en el dispositivo laboratorio agrego 1 lista de Miroslav Strampar Hagezi pro +, 1 lista de Steven Black y mi denylist personal con los dominios cazados, eso es para reconocer los dominios que manejan por capas, C2, carriier, adware, actores UAT y el odm con su Jenkins segunda capa es Pcap Droid como tunel de filtro pcap permite que puedas usar dns en ipv4 e ipv6 eso clave, yo en lo personal uso quad9 en 9.9.9.9:853 y 2620:fe::9:853 quad9 es el mas rápido de resolución actualmente en latam y se nutre de Iocs diarios de Threat intel

este es un ejemplo de log de next dns durante tengo los claves en mis repositorios sabes que llegan a ser enormes github.com/lexs201992-gif/Lo… y este es uno pcap la ventaja es que en pcap con todas las reglas de contención puedes ver los handshakes analizarlos integrarlos a umbrela y sino pcap solo con quad9 contiene todo el ataqué lo que es claro es que se equivocan los que buscan una vpn para ser anónimos la clave de la dns es cortar el c2 y aportar privacidad que no es lo mismo que anónimidad github.com/lexs201992-gif/Lo…

Lo mas macabro del asunto que es Modelo de negocio incluye a los carrier canales Voip Amxmx y rcs ademas de incluir en Samsung y otros oem a Digital Turbine ignite e Inmobi dos brokers de datos mundiales en cualquier dispositivo pre instaladas en system priv app

Felicidades al Gobierno de Guanajuato por la medida de contención del 2 de oct. Suspender los 135 kioscos como medida preventiva fue correcto. Les explico por qué es fantástica: esos kioscos operan como portales cautivos. Un solo celular Motorola con chip Unisoc T606/T616 (Moto G04s, G24, E24) infectado de fábrica puede crear un portal falso con Passpoint 2.0 + OSU Login y usando BouncyCastle inyectar una CA falsa en KeyChain/CertInstaller. Así atrapa el tráfico de todos los ciudadanos que hacen trámite ahí sin que lo noten, vía tethering + QUIC UDP 443. Apagar el kiosco ahoga ese vector. Es como quitarle el enchufe al atacante. Evita robo de datos personales y protege los servicios del estado. Si esa fue la razón, excelente protocolo. Ojalá se replique.