TINYWHALE
TINYWHALE is an Android-focused downloader used in Russia-linked operations targeting Ukrainian military/government personnel and defense-sector-related users. It has been reported in campaigns where Android malware families (including STALECOOKIE) masquerade as battlefield management platforms such as DELTA and Kropyva. In observed activity attributed to Russian clusters UNC4221 and referenced alongside UNC5792, TINYWHALE was delivered via ClickFix and used to drop MeshAgent remote management software, enabling remote management of the compromised device. The broader campaign context indicates objectives consistent with espionage and account/data access against battlefield-relevant targets; however, the specific, directly stated function of TINYWHALE in the provided content is as a downloader that installs MeshAgent.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
UNC5792 and UNC4221 ... deploy malware including STALECOOKIE and TINYWHALE.
"...deliver the TINYWHALE downloader that, in turn, drops the MeshAgent remote management software."
Techniques & procedures
1 distinct technique documented for this family, organized by ATT&CK tactic.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android-targeting malware used to steal cookies and facilitate remote management/access.
Malware deployed following account-hijack/phishing activity abusing Signal/WhatsApp features (no further functional detail provided).
Downloader used to fetch and install additional payloads, specifically MeshAgent RMM software.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.