Loading threat actor…
Monokle is a custom Android spyware family associated with Special Technology Centre (STC), a Russian contractor based in St. Petersburg and linked in public reporting to Russian government interests. It is used for covert surveillance and data theft on mobile devices and has been assessed as part of Russia’s broader state-aligned mobile espionage capability. Monokle is notable for extensive device-monitoring and collection functions, including location tracking, call recording, keylogging, screen capture, file theft, stored password extraction, access to messages from other applications, shell command execution, and extraction of device unlock credentials. Reported variants also support real-time audio and video streaming and use Android accessibility features to expand collection and control. Tradecraft associated with Monokle includes disguising spyware as legitimate Android applications, storing encrypted secondary stages within application assets, and using attacker-controlled certificates to facilitate interception and exfiltration. Later samples attributed or linked to Monokle show continuity with earlier versions through overlapping command structures and operational design, while also demonstrating evolution in configuration protection, staging, and permission use. Public reporting has described recent samples as either updated Monokle variants or new spyware reusing substantial Monokle code. Monokle has been discussed in the context of surveillance against individuals of interest to Russian authorities, including Russian dissidents, and more broadly as part of Russian mobile-focused espionage operations that have also prioritized Ukraine.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
Attributed origin per open-source reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Advanced mobile spyware family assessed to be either an updated version of Monokle or new software reusing much of the same code, covertly implanted on a detained Russian programmer’s Android device to enable surveillance including location tracking, call recording, keylogging, message access, screen capture, file extraction, password theft, JavaScript injection, shell command execution, and device administration abuse.
Monokle is a custom Android spyware developed by STC, a Russian contractor, for espionage. It uses advanced data exfiltration techniques, including accessibility service abuse and AiTM attacks, and has been deployed in highly targeted attacks.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.