MalwareUsed by 1 actor

GALLGRAB

GALLGRAB is an Android-focused malware family observed in attacks targeting Ukrainian military/battlefield users and the defense industrial base context. It has been reported as delivered via WhatsApp (including by the Russia-linked cluster UNC6096) using DELTA-themed social-engineering lures. The malware’s described capabilities include collecting locally stored files and contact information from the device, and it may also collect encrypted user data from specialized battlefield applications. No additional high-confidence details on C2, persistence mechanisms, or specific indicators of compromise were provided in the source content.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

UNC6096

UNC6096 used WhatsApp to deliver Windows and Android malware, including GALLGRAB.

via security affairssecurityaffairs.com

MITRE ATT&CK

Techniques & procedures

2 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

“UNC6096 used WhatsApp to deliver Windows and Android malware, including GALLGRAB.”

Stealth

1 technique

T1036MasqueradingEvidence1

STALECOOKIE , TINYWHALE , and MeshAgent target Android devices, mimicking legitimate battlefield management platforms like DELTA and Kropyva... GALLGRAB and CraxsRAT are distributed via WhatsApp and fake updates, respectively.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

rescana blogNews

Feb 15, 2026

Coordinated State-Sponsored Cyber Attacks Target Battlefield Management and Defense Supply Chains: Google Links China, Iran, Russia, North Korea

Malware distributed via WhatsApp (as described).

security affairsNews

Feb 14, 2026

Suspected Russian hackers deploy CANFAIL malware against Ukraine

Malware delivered via WhatsApp to Windows and Android targets by UNC6096 (no further functional detail provided).

the hacker newsNews

Feb 13, 2026

Google Links China, Iran, Russia, North Korea to Coordinated Defense Sector Cyber Operations

Android malware that collects local files and contacts and may access encrypted user data from specialized battlefield applications.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping2

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.