Infamous Chisel
Infamous Chisel is an Android malware family attributed to Sandworm, the Russian state-sponsored threat actor linked to GRU Unit 74455 and also tracked as APT44 / Seashell Blizzard. Public reporting from the NCSC and Five Eyes partners described it in August 2023 as a mobile malware strain targeting Android devices used by the Ukrainian military, including Ukrainian armed forces devices. Reported capabilities include enabling unauthorized access to compromised devices, scanning files, monitoring traffic, and periodically stealing sensitive information. The malware is described as an advanced Android implant with several persistence mechanisms and an unusual command-and-control system, and it searches for mobile applications specific to the Ukrainian military. Reporting also notes Sandworm targeted cryptocurrencies in its Infamous Chisel tooling. High-confidence context ties the malware to Sandworm’s broader mobile operations against Ukraine.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Also, Sandworm APT targeted cryptocurrencies in their Infamous Chisel tooling which targeted Ukrainian armed forces’ Android devices.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android-focused tooling associated in the content with Sandworm APT and cryptocurrency targeting against Ukrainian armed forces’ devices.
Malware family attributed to Sandworm and documented in a Five Eyes malware analysis report; used for post-compromise access and data collection on infected devices.
Android malware/backdoor with advanced persistence, C2 via Tor and SSH, network monitoring, local scanning, and exfiltration capabilities. Used for targeting Ukrainian military devices.
Infamous Chisel is Android malware used for cyber espionage, enabling unauthorized access, file scanning, traffic monitoring, and data exfiltration from compromised devices, primarily targeting the Ukrainian military.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.