Dracarys

Dracarys is an Android malware/spyware family active by 2022 and linked by multiple researchers to the South Asian threat group BITTER, also tracked as T-APT-17 and APT-Q-37. Reporting tied Dracarys to an espionage campaign that used fake websites impersonating trusted services including YouTube, Signal, Telegram, and WhatsApp to distribute the malware. Infrastructure associated with the campaign included youtubepremiumapp[.]com, which Cyble and Meta previously linked to a BITTER operation distributing Dracarys. Lookout later connected newer Android spyware activity to BITTER in part through code similarities between ProSpy and the earlier Dracarys malware, noting similarly named worker classes and the use of the same numbered command-and-control commands to control infected phones; Lookout also noted that Dracarys was implemented in Java, while ProSpy used Kotlin. The broader BITTER activity described in the reporting has historically targeted military, energy, and government organizations in China, Pakistan, and Saudi Arabia, and later expanded to activists and journalists in Egypt, Lebanon, Bahrain, and the UAE. High-confidence capabilities explicitly described for Dracarys in the provided content are limited; however, it is directly described as Android malware used in an espionage operation and as a predecessor closely related in code and command structure to later BITTER-linked Android spyware.