Loading threat actor…
Softpatch is an underground malware developer and partner associated with the WebMonitor ecosystem. The actor is specifically linked to offering an Android remote access trojan client as part of the broader WebMonitor operation and publicly posting its source code. WebMonitor itself is a commodity remote access trojan sold through cybercrime channels using a hosted command-and-control service model, indicating Softpatch operated within a criminal malware distribution and support ecosystem rather than as an independent nation-state intrusion set. High-confidence reporting ties Softpatch to Android RAT development within this ecosystem, but does not provide sufficient corroborated detail to attribute broader operational responsibility for WebMonitor’s Windows malware, infrastructure management, victimology, or intrusion activity directly to Softpatch. As a result, Softpatch is best characterized as a malware partner or collaborator involved in tooling development and initial-access or post-compromise enablement through remote access capabilities. No verified aliases, sub-groups, country attribution, or distinct victim targeting profile are established at high confidence.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
11 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.