Loading story…
Researchers detailed the discovery of Geost, a previously unknown Android banking botnet that targeted users in Russia and harvested SMS messages, banking data, and other sensitive information from infected devices. Analysis indicated the operation relied on at least 13 command-and-control servers, more than 140 domains, and over 150 Android APKs, with one observed server alone suggesting a conservative victim count of roughly 871,200 devices. The malware monitored account balances and appeared to target several major Russian banks and payment services, placing it among the more significant mobile banking threats documented in the region.
The botnet was uncovered after multiple operational security mistakes by its operators exposed internal activity and infrastructure. Investigators found Geost administrators using the HtBot illegal proxy network, sending unencrypted C2 traffic, reusing infrastructure, and maintaining poorly secured developer communications that leaked credentials and Skype chat logs. Those errors allowed researchers to map relationships between aliases, infrastructure, and probable members of the underground group behind the malware, while broader reporting on Android banking malware such as Asacub underscored the continuing rise of mobile banker campaigns aimed at financial theft.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Trend Micro released a detailed reverse-engineering analysis of Geost, describing its distribution via unofficial websites, multi-stage architecture, obfuscation, persistence mechanisms, and command-and-control features. The report also documented capabilities including SMS interception, theft of contacts and call logs, remote device locking, and other operator commands, and provided indicators of compromise.
Researchers obtained a leaked Skype chat log tied to people related to the Geost operation, containing unencrypted credentials, links, wallet identifiers, and other sensitive data. The log spanned more than 6,200 lines over eight months and helped reveal internal relationships and probable members connected to the botnet.
The investigation found that Geost used at least 13 command-and-control servers, more than 140 malicious domains, and over 150 Android APK samples. Based on one observed server showing about 72,600 victims, the researchers conservatively estimated roughly 871,200 victims across the botnet's infrastructure.
Researchers identified Geost as a previously unknown Android banking botnet targeting Russian users after analyzing traffic that passed through a monitored HtBot malware proxy node used by the botmasters. The discovery was enabled by multiple operational security failures, including unencrypted command-and-control traffic.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 113 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
trendmicro.com
Open sourcevirusbulletin.com
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported that leaked source code for the Android banking malware **GM Bot** enabled broader criminal reuse of a trojan capable of stealing banking credentials, intercepting SMS messages, and bypassing two-factor authentication. IBM said the malware—also tracked under names including **Slempo**, **Bankosy**, **Acecard**, and **MazarBot**—abused Android activity hijacking on older devices to display fake login overlays on legitimate banking apps, making the leak significant because it lowered the barrier for other actors to build or modify mobile banking trojans. ESET later linked publicly released Android banker and command-and-control source code from a Russian forum to an active banking botnet campaign distributed through trojanized weather apps on **Google Play**. The newer malware, detected as `Trojan.Android/Spy.Banker.HW`, posed as **World Weather**, expanded targeting from 22 Turkish banks to 69 banking apps across Turkey, the UK, Germany, and Austria, and added stronger obfuscation while retaining SMS interception and remote lock and unlock functions. An exposed control panel showed more than **2,800 infected devices**, and the hosting provider removed the C2 server after notification.
Aug 15, 2026
The Android banking trojan **BankBot** expanded rapidly after the source code for its precursor, **BankBotAlpha**, and its PHP command-and-control panel were posted on a Russian forum, enabling multiple copycat variants and new campaigns. Researchers found the malware requesting **Device Administrator** privileges, hiding its launcher icon, intercepting and deleting SMS messages, collecting device identifiers and banking-app data, and sending stolen information to attacker-controlled servers. Early variants focused heavily on Russian and Ukrainian banks and included phishing templates for **PrivatBank** and **Visa QIWI Wallet**, while later samples broadened targeting and added stronger evasion and credential-theft capabilities.
Aug 15, 2026
Researchers reported that the **Gustuff** Android banking trojan evolved from an earlier malware family into a more capable fraud platform that spreads mainly through SMS links to malicious APKs and social-media-themed lures. Initially marketed on Russian-speaking criminal forums as an updated version of AndyBot, Gustuff was offered for lease and aimed largely at victims outside Russia. The malware was observed targeting users in Australia and other countries including the United States, Poland, Germany, and India, with victim lists spanning more than 100 banking apps, dozens of cryptocurrency services, fintech platforms, marketplaces, payment systems, messengers, hiring apps, and the Australian Government Portal. The updated malware relies heavily on Android **Accessibility Service** to automate on-device fraud, including interacting with legitimate apps, displaying fake push notifications and overlays, and using an Automatic Transfer System to fill transaction fields. Researchers said newer versions reduced static indicators by loading target app lists dynamically from command-and-control servers and added JavaScript-based scripting, asynchronous task handling, improved command tracking, and an interactive mode for automated actions on infected devices. Gustuff also retained broad device-control features, including reading and sending SMS messages, issuing USSD requests, exfiltrating files and device data, launching a SOCKS5 proxy, disabling Google Protect in many cases, resetting devices, and maintaining resilience through an SMS-based secondary administrative channel when primary C2 infrastructure was disrupted.
Aug 15, 2026