Loading threat actor…
MR ROBOT is a financially motivated Android Malware-as-a-Service operation targeting banking customers in India. It rents affiliates subscription-based access to customized banking trojans, Telegram-based application-building and distribution tools, and a web-based victim-management panel. Its operating model includes affiliate-specific licenses with expiration dates and a hierarchy of affiliates and subordinate administrators. The individuals operating the service and their country of origin are not established. The operation distributes malicious Android applications impersonating banks, identity-update services, utility providers, transport-related services, and government services. An encrypted, compressed payload delivers a banking trojan that uses HTML overlays to capture online-banking credentials, payment-card details, financial PINs, and Indian identity information. The malware intercepts SMS messages and one-time passwords and enables call forwarding to redirect telephone-based authentication. Stolen information is exfiltrated through Firebase Realtime Database and Telegram. Defense-evasion measures include emulator checks, delayed activation, concealment of the application icon, and randomized signing certificates across builds. The management platform supports victim administration, SMS interception, call forwarding, and on-demand generation of malicious applications. MR ROBOT shares techniques with the FatBoyPanel and RedWing clusters, but these similarities do not establish common ownership or operator attribution.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.