Official account of the @GroupIB Threat Intelligence Unit. Latest research, analytics, IOCs and threat alerts.
Joined January 2023
- Tweets495
- Following182
- Followers17.8K
- Likes826
Pinned Tweet
Group-IB identified a sophisticated #Androidmalware campaign by the financially motivated threat cluster #CyberDakait targeting India’s financial services sector since July 2025. The operation deploys seven distinct Android trojan families through coordinated smishing and vishing campaigns in which threat actors impersonate representatives of different Indian banks and other financial institutions. Targeted individuals are routed to phishing websites that drop malicious APK files designed to harvest sensitive data, including mobile banking credentials, credit card details, card images, and account balances. The malicious APKs are commonly hosted on #GitHub and act as droppers, installing a RAT alongside an XMRig cryptocurrency mining component. In several cases, the malware presents a fake Google Play update page while silently downloading and installing an additional malicious payload in the background. #ThreatIntelligence
Group-IB has uncovered #MadApe, a previously undocumented #phishingkit that abuses Microsoft's legitimate Device Code authentication flow to take over #Microsoft365 accounts without collecting a password. The campaign uses business-themed PDF lures, multi-stage redirect chains, and fake document-sharing pages to trick victims into completing the authentication on Microsoft's own portal, effectively bypassing traditional credential-harvesting defenses and satisfying #MFA requirements.
Infrastructure analysis expanded the dataset to 155 root domains, with #DeviceCodePhishing components observed on dedicated subdomains or URL paths associated with 97 of them. Shared decoy content, coordinated domain registration patterns including same-second registrations through Dynadot, and a common subdomain naming convention tie the infrastructure to a single provisioning pipeline, with the kit's own operator panel exposed on the same hosts serving the #phishing pages and decoy sites.
How does MadApe abuse Microsoft Device Code authentication to bypass password-based defenses and achieve account takeover? Read the full technical analysis on the Group-IB blog: link.group-ib.com/3WTSb4X
Although CyberDakait’s seven Android malware families share #phishing themes, packers, XMRig-based #cryptojacking, and RAT capabilities such as SMS interception, SMS forwarding, call forwarding, and credit card theft through phishing overlays, technical analysis revealed significant differences in their network communication, database structures, and telemetry formats. These differences led Group-IB to track GhostBat, cyb3rx, godz, d-passive, d-shine, tenxen, and appkjl as distinct malware families rather than variants of a single shared codebase. The campaign also uses persistence mechanisms including wake locks, a silent audio loop, foreground services, and requests to disable Android battery optimization, helping malicious processes remain active while RAT and mining components operate in the background. #MalwareAnalysis
CyberDakait combines social engineering, Android malware, phishing infrastructure, RAT functionality, cryptojacking, and operator-controlled C2 tooling into a persistent financial fraud operation. Group-IB’s investigation found malicious APK distribution through GitHub, multiple C2 architectures across seven malware families, Android-based malware development using tools such as AIDE, MT Manager, Acode, and Apktool M, and a dedicated Cyb3rx controller used to manage infected devices. Read the full technical analysis for the infection chain, malware family classification, victimology, C2 communication, operator tooling, indicators of compromise, infrastructure, and defensive recommendations: link.group-ib.com/4zYErEw
First observed in April 2026, #SiriusQT is more than just another Windows RAT. Our investigation uncovered more than 280 publicly available SiriusQT client samples linked to different campaigns and identified 146 unique licenses, 110 of which were leaked. At least 30 users purchased valid licenses, while 30-day, 90-day, lifetime, and customized license periods point to an active commercial ecosystem around the #malware. #ThreatIntelligence
SiriusQT uses a custom encrypted command-and-control (C2) protocol over TCP. Each TCP message begins with a 4-byte little-endian payload length transmitted in cleartext, followed by an encrypted payload. The encryption mechanism relies on a custom stream-cipher-like routine. The #RAT also supports multiple process injection techniques, including Process Hollowing, APC-based injection (including Early Bird), and Remote Thread Injection. Additionally, it dynamically resolves Windows APIs by traversing the Process Environment Block (PEB) and using a custom FNV-1-style hashing algorithm. #cybercrime
How did a Windows RAT advertised with a US$500 lifetime license evolve into a broader ecosystem of paid subscriptions, leaked licenses, and cracked builds? Our latest technical analysis goes inside #SiriusQT to examine its server and client components, licensing model, distribution, infrastructure. We also examine its post-compromise capabilities, including HVNC, credential theft, custom encrypted C2 communications, and multiple process injection techniques. Read more: link.group-ib.com/4kaseaU
A campaign linked to threat actor #k0t exposed more than 70,000 credentials and related data, including network device credentials and LDAP dumps. The operators targeted internet-facing FortiGate, FortiWeb, and Palo Alto GlobalProtect systems at scale, using public scanning services such as FOFA, ZoomEye, and Censys combined with target lists from underground sources to identify potential victims. #ThreatIntel
Compromising the edge device was only the first step. The operators used tools including NetExec, Impacket, noPac, Kerbrute, PetitPotam, and Mimikatz to steal credentials, escalate privileges and move through victim environments. MeshCentral, Atera, AnyDesk, Teramind, and ngrok supported persistent remote access, while AdaptixC2 provided an additional command-and-control channel. Rclone was used to exfiltrate data to Wasabi S3 and MEGA. #CredentialTheft
The investigation identified overlaps between organizations compromised in this campaign and victims later listed by #Ransomware groups including #qilin and #thegentlemen. Although the relationship with these groups remains unconfirmed, the findings indicate that the operators may potentially be acting as Initial Access Brokers. Read the full technical analysis: link.group-ib.com/4yDaMQY
Group-IB researchers analyzed #KGBRAT, a Windows Remote Access Trojan (RAT) sold as Malware-as-a-Service (#MaaS). Its capabilities combine keylogging, credential theft, hidden desktop access through HVNC, and ransomware functionality in a configurable builder. Our analysis also identified evidence of multiple operators using a common builder, with different configurations and infrastructure. #MalwareAnalysis
KGB RAT also combines direct command-and-control (C2) communication with #Telegram based victim notifications. Group-IB observed outbound requests to api.telegram.org and ip-api.com, which the #malware uses to notify operators and retrieve victim geolocation data. Monitoring unexpected outbound connections from endpoint processes, alongside system and process behavior, can help defenders identify suspicious activity. #Cybersecurity
How can defenders detect KGB RAT when its samples are obfuscated or packed with a crypter? Group-IB’s Malware Detonation Platform uses behavioral analysis to expose execution activity, capture in-memory processes, and apply YARA rules during deobfuscation. Read the technical analysis for the malware’s execution chain, configuration findings, indicators of compromise, and detection recommendations: link.group-ib.com/4s1dpJM
