Official account of the @GroupIB Threat Intelligence Unit. Latest research, analytics, IOCs and threat alerts.
- Tweets 491
- Following 182
- Followers 17,749
- Likes 822
Pinned Tweet
Group-IB identified a sophisticated #Androidmalware campaign by the financially motivated threat cluster #CyberDakait targeting India’s financial services sector since July 2025. The operation deploys seven distinct Android trojan families through coordinated smishing and vishing campaigns in which threat actors impersonate representatives of different Indian banks and other financial institutions. Targeted individuals are routed to phishing websites that drop malicious APK files designed to harvest sensitive data, including mobile banking credentials, credit card details, card images, and account balances. The malicious APKs are commonly hosted on #GitHub and act as droppers, installing a RAT alongside an XMRig cryptocurrency mining component. In several cases, the malware presents a fake Google Play update page while silently downloading and installing an additional malicious payload in the background. #ThreatIntelligence
1
5
15
1,024
Group-IB identified a sophisticated #Androidmalware campaign by the financially motivated threat cluster #CyberDakait targeting India’s financial services sector since July 2025. The operation deploys seven distinct Android trojan families through coordinated smishing and vishing campaigns in which threat actors impersonate representatives of different Indian banks and other financial institutions. Targeted individuals are routed to phishing websites that drop malicious APK files designed to harvest sensitive data, including mobile banking credentials, credit card details, card images, and account balances. The malicious APKs are commonly hosted on #GitHub and act as droppers, installing a RAT alongside an XMRig cryptocurrency mining component. In several cases, the malware presents a fake Google Play update page while silently downloading and installing an additional malicious payload in the background. #ThreatIntelligence
1
5
15
1,024
Although CyberDakait’s seven Android malware families share #phishing themes, packers, XMRig-based #cryptojacking, and RAT capabilities such as SMS interception, SMS forwarding, call forwarding, and credit card theft through phishing overlays, technical analysis revealed significant differences in their network communication, database structures, and telemetry formats. These differences led Group-IB to track GhostBat, cyb3rx, godz, d-passive, d-shine, tenxen, and appkjl as distinct malware families rather than variants of a single shared codebase. The campaign also uses persistence mechanisms including wake locks, a silent audio loop, foreground services, and requests to disable Android battery optimization, helping malicious processes remain active while RAT and mining components operate in the background. #MalwareAnalysis
1
1
1
219
CyberDakait combines social engineering, Android malware, phishing infrastructure, RAT functionality, cryptojacking, and operator-controlled C2 tooling into a persistent financial fraud operation. Group-IB’s investigation found malicious APK distribution through GitHub, multiple C2 architectures across seven malware families, Android-based malware development using tools such as AIDE, MT Manager, Acode, and Apktool M, and a dedicated Cyb3rx controller used to manage infected devices. Read the full technical analysis for the infection chain, malware family classification, victimology, C2 communication, operator tooling, indicators of compromise, infrastructure, and defensive recommendations: link.group-ib.com/4zYErEw
1
141
First observed in April 2026, #SiriusQT is more than just another Windows RAT. Our investigation uncovered more than 280 publicly available SiriusQT client samples linked to different campaigns and identified 146 unique licenses, 110 of which were leaked. At least 30 users purchased valid licenses, while 30-day, 90-day, lifetime, and customized license periods point to an active commercial ecosystem around the #malware. #ThreatIntelligence
1
7
26
1,906
SiriusQT uses a custom encrypted command-and-control (C2) protocol over TCP. Each TCP message begins with a 4-byte little-endian payload length transmitted in cleartext, followed by an encrypted payload. The encryption mechanism relies on a custom stream-cipher-like routine. The #RAT also supports multiple process injection techniques, including Process Hollowing, APC-based injection (including Early Bird), and Remote Thread Injection. Additionally, it dynamically resolves Windows APIs by traversing the Process Environment Block (PEB) and using a custom FNV-1-style hashing algorithm. #cybercrime
1
1
2
292
How did a Windows RAT advertised with a US$500 lifetime license evolve into a broader ecosystem of paid subscriptions, leaked licenses, and cracked builds? Our latest technical analysis goes inside #SiriusQT to examine its server and client components, licensing model, distribution, infrastructure. We also examine its post-compromise capabilities, including HVNC, credential theft, custom encrypted C2 communications, and multiple process injection techniques. Read more: link.group-ib.com/4kaseaU
1
4
201
A campaign linked to threat actor #k0t exposed more than 70,000 credentials and related data, including network device credentials and LDAP dumps. The operators targeted internet-facing FortiGate, FortiWeb, and Palo Alto GlobalProtect systems at scale, using public scanning services such as FOFA, ZoomEye, and Censys combined with target lists from underground sources to identify potential victims. #ThreatIntel
1
4
15
2,094
Compromising the edge device was only the first step. The operators used tools including NetExec, Impacket, noPac, Kerbrute, PetitPotam, and Mimikatz to steal credentials, escalate privileges and move through victim environments. MeshCentral, Atera, AnyDesk, Teramind, and ngrok supported persistent remote access, while AdaptixC2 provided an additional command-and-control channel. Rclone was used to exfiltrate data to Wasabi S3 and MEGA. #CredentialTheft
1
1
1
418
The investigation identified overlaps between organizations compromised in this campaign and victims later listed by #Ransomware groups including #qilin and #thegentlemen. Although the relationship with these groups remains unconfirmed, the findings indicate that the operators may potentially be acting as Initial Access Brokers. Read the full technical analysis: link.group-ib.com/4yDaMQY
1
272
Group-IB researchers analyzed #KGBRAT, a Windows Remote Access Trojan (RAT) sold as Malware-as-a-Service (#MaaS). Its capabilities combine keylogging, credential theft, hidden desktop access through HVNC, and ransomware functionality in a configurable builder. Our analysis also identified evidence of multiple operators using a common builder, with different configurations and infrastructure. #MalwareAnalysis
1
18
83
5,389
KGB RAT also combines direct command-and-control (C2) communication with #Telegram based victim notifications. Group-IB observed outbound requests to api.telegram.org and ip-api.com, which the #malware uses to notify operators and retrieve victim geolocation data. Monitoring unexpected outbound connections from endpoint processes, alongside system and process behavior, can help defenders identify suspicious activity. #Cybersecurity
1
3
3
417
How can defenders detect KGB RAT when its samples are obfuscated or packed with a crypter? Group-IB’s Malware Detonation Platform uses behavioral analysis to expose execution activity, capture in-memory processes, and apply YARA rules during deobfuscation. Read the technical analysis for the malware’s execution chain, configuration findings, indicators of compromise, and detection recommendations: link.group-ib.com/4s1dpJM
3
6
329
ASOS customers received an unauthorized push notification on 6 October claiming the company’s Snowflake environment had been compromised and threatening a #dataleak. The message directed users to a #Telegram channel linked to a group calling itself Xuanye. Our read: #Xuanye is a newly surfaced extortion identity, but the operators behind it may not be new.
1
8
26
3,186
The notable tactic here is the use of a customer-facing notification channel to push the extortion attempt directly in front of users, then move the conversation to Telegram. That creates pressure before the technical picture is clear. For defenders, the key is to separate actor claims from what can actually be verified, especially around #datatheft, access and attribution. #Cybersecurity
1
1
2
309
Supply chain compromise remains a key trend for 2026. As we highlighted in High-Tech Crime Trends, attackers are increasingly targeting SaaS platforms, vendors and trusted integrations because one compromised access point can create downstream impact across multiple organizations. #HTCT2026 #SupplyChainAttack
1
2
260