The botnet enters through the Android Debug Bridge port and spreads through SSH.
Source: https://www.coindesk.com/trendmicro-detects-crypto-mining-malware-affecting-android-devices
TrendMicro Detects Crypto-Mining Malware Affecting Android Devices
June 23, 2019
CoinDesk
