BTMOB RATMalware
According to Cyble, this is an advanced Android malware evolved from SpySolr that features remote control, credential theft, and data exfiltration. It spreads via phishing sites impersonating streaming services like iNat TV and fake mining platforms. The malware abuses Android’s Accessibility Service to unlock devices, log keystrokes, and automate credential theft through injections.From MISP Galaxy
Last reported 4 days ago, by The Hacker News1 report
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader“UAC-0263 distributes BTMOB RAT, which gives the threat actor control over the infected device and the ability to exfiltrate data.”
Indicators in its reports
named in the reports above- 185.82.218[.]119in 1 report
- 91.149.221[.]118in 1 report
- 91.149.221[.]123in 1 report
- 166.88.239[.]54in 1 report
- 194.87.108[.]12in 1 report
- 194.87.108[.]217in 1 report
Copy these 6 indicators · defanged
Thanks — we review every report.