Malware

SilentSDK

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

17 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1195Supply Chain CompromiseEvidence1

Каждый SDK - потенциальный вектор supply chain атаки... Атакующий модифицирует SDK так, чтобы он выполнял легитимные функции, параллельно собирая данные или предоставляя удалённый доступ.

T1195.002Compromise Software Supply ChainEvidence1

Место в цепочке атаки: supply chain через троянизированный SDK Атака через Compromise Software Supply Chain (T1195.002, Initial Access) ... Вместо прямого фишинга или сайдлоада злоумышленник компрометирует звено в цепочке разработки: SDK аналитики, рекламный модуль, библиотеку push-уведомлений.

Execution

1 technique

T1059Command and Scripting InterpreterEvidence2

Key findings include a Remote Access Trojan capable of loading arbitrary code, detailed event logging/spyware, and ad injection components - all running with SYSTEM privileges.

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

The malware uses a "Byte-Reversal" trick on APK payloads.

T1027.009Embedded PayloadsEvidence1

Defense Evasion - ... зашифрованный payload в нативной библиотеке скрывает вредоносный код от статического анализа (T1027.009)

T1036.005Match Legitimate Resource Name or LocationEvidence1

Defense Evasion - второй этап маскируется под системный компонент: Google Play Services, analytics framework (T1036.005)

T1218System Binary Proxy ExecutionEvidence1

Key findings include a Remote Access Trojan capable of loading arbitrary code, detailed event logging/spyware, and ad injection components - all running with SYSTEM privileges.

Credential Access

2 techniques

T1056Input CaptureEvidence1

Key findings include a Remote Access Trojan capable of loading arbitrary code, detailed event logging/spyware, and ad injection components - all running with SYSTEM privileges.

T1056.001KeyloggingEvidence1

Collection - финальный RAT собирает SMS, контакты, нажатия клавиш (T1056.001)

Discovery

1 technique

T1082System Information DiscoveryEvidence1

Decrypted strings reveal remote command execution, chmod 777 on secondary payloads, and deep device fingerprinting.

Collection

4 techniques

T1005Data from Local SystemEvidence1

Collection - финальный RAT собирает ... файлы устройства (T1005)

T1056Input CaptureEvidence1

Key findings include a Remote Access Trojan capable of loading arbitrary code, detailed event logging/spyware, and ad injection components - all running with SYSTEM privileges.

T1056.001KeyloggingEvidence1

Collection - финальный RAT собирает SMS, контакты, нажатия клавиш (T1056.001)

T1113Screen CaptureEvidence1

Collection - финальный RAT собирает ... скриншоты (T1113)

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

a persistent RAT (SilentSDK) that communicates with a C2 server in China (api.pixelpioneerss.com).

T1105Ingress Tool TransferEvidence1

The malware uses a "Byte-Reversal" trick on APK payloads.. RAT Capabilities: Decrypted strings reveal remote command execution, chmod 777 on secondary payloads

T1219Remote Access ToolsEvidence1

Command and Control - управление по WebSocket через двунаправленный канал (T1219)

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Exfiltration - данные уходят по тому же C2-каналу (T1041)

Other

1 technique

T1562.001Disable or Modify ToolsEvidence1

A standard updater doesn't need a hidden root shell, chmod 777 for remote files, or a custom TrustManager to intentionally bypass SSL validation.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app6 months ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

codebyNews

Jun 7, 2026

Пентест мобильных приложений: методология и инструменты

Described as a remote access trojan embedded inside a legitimate mobile SDK/library, representing a supply-chain attack vector.

codebyNews

May 24, 2026

Reverse engineering мобильного SDK: скрытый RAT в библиотеке

A composite/sample name for a trojanized mobile SDK scenario built from documented techniques of cifrat and TaxiSpy, delivering a hidden RAT via software supply chain compromise.

reddit netsecNews

Apr 12, 2026

Reverse engineered SilentSDK - RAT and C2 infrastructure found on beamers, sold on Amazon/AliExpress/eBay : r/netsec

A persistent remote access trojan/backdoor factory-installed on cheap Android projectors. The analysis describes C2 communications, remote command execution, chmod 777 on secondary payloads, deep device fingerprinting, and use of a custom TrustManager to bypass SSL validation.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping17

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

SilentSDK

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

17 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1195Supply Chain CompromiseEvidence1

T1195.002Compromise Software Supply ChainEvidence1

Execution

1 technique

T1059Command and Scripting InterpreterEvidence2

Key findings include a Remote Access Trojan capable of loading arbitrary code, detailed event logging/spyware, and ad injection components - all running with SYSTEM privileges.

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

The malware uses a "Byte-Reversal" trick on APK payloads.

T1027.009Embedded PayloadsEvidence1

T1036.005Match Legitimate Resource Name or LocationEvidence1

Defense Evasion - второй этап маскируется под системный компонент: Google Play Services, analytics framework (T1036.005)

T1218System Binary Proxy ExecutionEvidence1

Key findings include a Remote Access Trojan capable of loading arbitrary code, detailed event logging/spyware, and ad injection components - all running with SYSTEM privileges.

Credential Access

2 techniques

T1056Input CaptureEvidence1

Key findings include a Remote Access Trojan capable of loading arbitrary code, detailed event logging/spyware, and ad injection components - all running with SYSTEM privileges.

T1056.001KeyloggingEvidence1

Collection - финальный RAT собирает SMS, контакты, нажатия клавиш (T1056.001)

Discovery

1 technique

T1082System Information DiscoveryEvidence1

Decrypted strings reveal remote command execution, chmod 777 on secondary payloads, and deep device fingerprinting.

Collection

4 techniques

T1005Data from Local SystemEvidence1

Collection - финальный RAT собирает ... файлы устройства (T1005)

T1056Input CaptureEvidence1

Key findings include a Remote Access Trojan capable of loading arbitrary code, detailed event logging/spyware, and ad injection components - all running with SYSTEM privileges.

T1056.001KeyloggingEvidence1

Collection - финальный RAT собирает SMS, контакты, нажатия клавиш (T1056.001)

T1113Screen CaptureEvidence1

Collection - финальный RAT собирает ... скриншоты (T1113)

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

a persistent RAT (SilentSDK) that communicates with a C2 server in China (api.pixelpioneerss.com).

T1105Ingress Tool TransferEvidence1

The malware uses a "Byte-Reversal" trick on APK payloads.. RAT Capabilities: Decrypted strings reveal remote command execution, chmod 777 on secondary payloads

T1219Remote Access ToolsEvidence1

Command and Control - управление по WebSocket через двунаправленный канал (T1219)

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Exfiltration - данные уходят по тому же C2-каналу (T1041)

Other

1 technique

T1562.001Disable or Modify ToolsEvidence1

A standard updater doesn't need a hidden root shell, chmod 777 for remote files, or a custom TrustManager to intentionally bypass SSL validation.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app6 months ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

codebyNews

Jun 7, 2026

Пентест мобильных приложений: методология и инструменты

Described as a remote access trojan embedded inside a legitimate mobile SDK/library, representing a supply-chain attack vector.

codebyNews

May 24, 2026

Reverse engineering мобильного SDK: скрытый RAT в библиотеке

A composite/sample name for a trojanized mobile SDK scenario built from documented techniques of cifrat and TaxiSpy, delivering a hidden RAT via software supply chain compromise.

reddit netsecNews

Apr 12, 2026

Reverse engineered SilentSDK - RAT and C2 infrastructure found on beamers, sold on Amazon/AliExpress/eBay : r/netsec

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping17

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.