Loading threat actor…
STNCJ (Service Technique National de Captation Judiciaire) is a French government technical interception and lawful hacking unit associated with the 2020 compromise of the EncroChat encrypted phone network used by organized crime groups across Europe. In reporting on that operation, STNCJ is identified alongside the French cybercrime unit C3N as one of the teams responsible for deploying a spyware implant to EncroChat devices through the platform’s update infrastructure. The operation used the Android/Linux kernel vulnerability CVE-2019-2215 for privilege escalation, after which the implant obtained root access, disabled SELinux, suppressed logging, and established persistence. The malware used Frida-based hooks to access plaintext data inside EncroChat applications and exfiltrate messages, passwords, images, notes, location-related data, and other stored content from infected devices. Analysis attributed to the operation indicates the implant copied data directly from endpoints rather than decrypting communications in transit, and that it also supported remote wipe functionality. The campaign reportedly infected more than 32,000 EncroChat devices over roughly two months and enabled near-real-time collection of user communications. The operation was directed against criminal users of EncroChat and was credited with thousands of arrests and major narcotics and cash seizures across Europe. STNCJ should be understood as a state lawful-intercept and offensive technical capability operated by France, rather than a conventional financially motivated cybercriminal or espionage intrusion set.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
11 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
3 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
French government technical interception unit described as conducting the EncroChat device compromise operation by exploiting CVE-2019-2215, using Frida-based spyware, and distributing the implant through the EncroChat update infrastructure.
French government hacking team that deployed malware implants against EncroChat devices, using the Bad Binder exploit and Frida-based hooks to gain root access, persist on devices, exfiltrate messages and other data, and support law-enforcement monitoring of tens of thousands of phones.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.