Ref: http://www.group-ib.com/index.php/7-nov ... -destroyed
September 18, 2014, Moscow - Group-IB has once again assisted the Directorate K of the Russian Ministry of Internal Affairs to investigate and suppress the activities of a criminal group that specialized in stealing funds from the bank accounts of individuals.
Towards the end of 2013, the security service of Sberbank detected a cyber attack on owners of Android smartphones. The attackers infected the phones with malicious software through mass mailing of MMS messages from "RomanticVK" or "VK_Gift" with the promise of a "romantic gift". When the unsuspecting users clicked the links, a virus was downloaded on their phones. The virus recharged the mobile phone account from a bank account linked to that mobile number. After that, it used the SMS service to withdraw the funds to the account of other subscribers of mobile operators and electronic payment systems.