Loading threat actor…
Stealth Mango is a threat-actor label associated with mobile surveillance activity linked to the Confucius intrusion set, a pro-India state-sponsored espionage actor active since at least 2013. The strongest corroborated reporting ties Stealth Mango to Android surveillanceware operations involving the Hornbill and SunBird malware families, which were used against individuals connected to Pakistan’s military and nuclear establishment as well as election officials in Kashmir. Confucius has also been associated with earlier Android malware such as ChatSpy. Operations attributed in this cluster focused on covert intelligence collection from mobile devices. Observed capabilities included exfiltration of call logs, contacts, device metadata, geolocation, images, messages, notifications, and WhatsApp content; screenshot capture; photo capture; audio recording; abuse of Android accessibility services for surveillance; and, in the case of SunBird, broader remote-access functionality including attacker-directed actions and command execution when elevated privileges were available. Hornbill operated in a lower-noise reconnaissance mode, selectively uploading changed data and monitoring device state and document activity, while SunBird functioned as a more feature-rich RAT with periodic bulk data uploads. The activity is consistent with espionage-motivated targeting in South Asia, especially against Pakistani government, military, and politically relevant individuals. Reporting also noted exposed victim data spanning additional countries, but the core targeting pattern remains centered on Pakistan and India-linked interests. The alias Stealth Mango appears in actor-reference material and malware-association metadata, but no distinct sub-group structure, independent branding, or ransomware/extortion activity is supported at high confidence from the available facts.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
6 malware families attributed to this actor across reporting.
1 additional family tracked in Mallory.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as a comparison to similar mobile surveillance behavior.
Listed as a named threat actor in association with the win.danabot entry.
Listed as a new actor associated with win.dbatloader.
Listed as a named threat actor in source data associated with the win.raccoon entry.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.