Lemon Group
Lemon Group is an Android-focused threat actor associated in the provided content with large-scale mobile-device monetization and abuse. The content states the group later rebranded as Durian Cloud SMS after Trend Micro published research on its operations in February 2022; in May, the operators removed some traces of the Lemon name while keeping the same servers intact. The content also places Lemon Group among the groups associated with BADBOX 2.0. According to the provided material, Lemon Group used multiple Android malware plugins to monetize infected devices through SMS interception, proxy services, account hijacking, ad fraud, and silent app installation or removal. Its SMS capability intercepted received SMS messages and extracted one-time passwords from services including WhatsApp, JingDong, Facebook, QQ, Line, and Tinder, supporting an SMS PVA business that provided phone numbers and OTP features to customers. A proxy plugin established reverse proxies on infected phones and enabled abuse of compromised devices’ network resources, supporting the operators’ DoveProxy business. A cookie plugin hooked Facebook-related apps, dumped Facebook cookies from app data directories, uploaded stolen cookies to command-and-control infrastructure, and harvested Facebook-related data including friends lists, profiles, and email addresses. A WhatsApp plugin was used to hijack WhatsApp sessions and send unwanted messages. The content states the cookie and WhatsApp plugins were used for overseas marketing operations, including posting marketing content through compromised Facebook accounts. Additional plugins displayed intrusive ads by hooking app launch activity and silently installed or uninstalled APKs based on command-and-control tasks. The provided content says monitoring identified more than 490,000 mobile numbers used for OTP requests tied to Lemon SMS and later Durian SMS services, and that infected devices under the actor’s control were observed in more than 180 countries. The most affected countries listed were the United States, Mexico, Indonesia, Thailand, Russia, South Africa, India, Angola, the Philippines, and Argentina. Known aliases directly mentioned in the content: Durian Cloud SMS.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Software & Services
- Media & Entertainment
Where they target
Geographies tied to known operations.
- 🇺🇸 United States
- 🇲🇽 Mexico
- 🇮🇩 Indonesia
- 🇹🇭 Thailand
- 🇷🇺 Russia
- 🇿🇦 South Africa
- 🇮🇳 India
- 🇦🇴 Angola
Tradecraft
8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
2 malware families attributed to this actor across reporting.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
One of multiple actor groups involved in BADBOX 2.0 ad fraud/residential proxy abuse ecosystem.
Operates a mobile malware ecosystem with plugins for SMS interception and OTP theft, reverse proxying via infected Android devices, Facebook cookie theft and account hijacking, WhatsApp session abuse for spam, ad injection, and silent app installation. The operation also supports SMS PVA and proxy monetization services and uses compromised accounts/devices for overseas marketing and infrastructure abuse.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.