Loading malware…
TINYWHALE is an Android-focused downloader used in Russia-linked operations targeting Ukrainian military/government personnel and defense-sector-related users. It has been reported in campaigns where Android malware families (including STALECOOKIE) masquerade as battlefield management platforms such as DELTA and Kropyva. In observed activity attributed to Russian clusters UNC4221 and referenced alongside UNC5792, TINYWHALE was delivered via ClickFix and used to drop MeshAgent remote management software, enabling remote management of the compromised device. The broader campaign context indicates objectives consistent with espionage and account/data access against battlefield-relevant targets; however, the specific, directly stated function of TINYWHALE in the provided content is as a downloader that installs MeshAgent.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
UNC5792 and UNC4221 ... deploy malware including STALECOOKIE and TINYWHALE.
"...deliver the TINYWHALE downloader that, in turn, drops the MeshAgent remote management software."
1 distinct technique documented for this family, organized by ATT&CK tactic.
STALECOOKIE , TINYWHALE , and MeshAgent target Android devices, mimicking legitimate battlefield management platforms like DELTA and Kropyva... GALLGRAB and CraxsRAT are distributed via WhatsApp and fake updates, respectively.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.