Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
----[ 2.4 Android Toybox Drop Location: home/user/Downloads/toybox/third_party_toybox KIM is heavily working on ToyBox for Android.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Drop /bin/smit binary. It then deletes the existing FortiOS symbolic link of /bin/smit... Drop /bin/toybox... deletes ... /bin/sh ... copies ... /bin/toybox to be the new /bin/sh... fortlinkd... deletes the original /bin/smit binary and replaces it... If the /bin/fgfm file exists, it is removed, and a new malware file is dropped in its place
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A modified Android ToyBox codebase maintained by the operator; the article notes divergence from the official repository but does not determine the exact malicious functionality.
A modified Android ToyBox codebase diverged from the official repository; the exact malicious functionality is not determined in the content.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.