Trend Micro clarifies that their analysts have confirmed that infected devices have undergone a process called re-flashing, where the original ROMs have been replaced with modified versions containing the Guerilla malware. The researchers identified over 50 distinct infected ROMs, targeting various Android device manufacturers.