Loading story…
Researchers detailed an Android implant known as poprd30.apk that was tied to Fancy Bear / APT28 / Sofacy and disguised as software related to Ukrainian artillery operations. The APK, also referred to as Попр-Д30.apk, was identified as a backdoor that contacted 69.90.132[.]215 and could collect extensive information from infected devices, including SMS messages, call logs, contacts, installed apps, browser history, Wi‑Fi status, mobile data usage, and files stored on the SD card. Although the malware did not request GPS permissions, investigators said it could still infer coarse location through base station and Wi‑Fi data, reinforcing concerns that the app could be used to monitor field units.
A follow-up technical analysis found the sample had been deliberately or accidentally corrupted so it would fail Android parsing checks, and researchers repaired it by removing an extra byte from res/drawable-mdpi/warnings.png, producing a valid signed APK with SHA-256 5b6ea28333399a73475027328812fb42259c12bb24b6650e5def94f4104f385e. The repaired package and related Linux samples showed overlapping tradecraft with X-Agent, including reused RC4 key material, similar command-and-control communication patterns, and encoding and response-check routines that linked the Android implant to broader Sofacy tooling. Analysts noted that such similarities strengthened the connection to X-Agent operations, while stopping short of treating code overlap alone as definitive attribution.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
In its update, CrySyS compared the Android sample's textbook RC4 implementation with related Linux XAgent samples that reused the same key material but used XOR-based routines instead. The update also released a YARA rule named sofacy_xagent to detect Linux Sofacy XAgent variants.
CrySyS reported that the analyzed poprd30.apk sample had been corrupted by an extra byte in res/drawable-mdpi/warnings.png, preventing installation and causing archive errors. After removing the byte, investigators restored a valid signed APK with SHA-256 hash 5b6ea28333399a73475027328812fb42259c12bb24b6650e5def94f4104f385e.
CrySyS analyzed the Android APK poprd30.apk (Попр-Д30.apk) and confirmed it contained backdoor functionality. The report documented communications with 69.90.132[.]215, data theft capabilities, and similarities to X-Agent associated with Fancy Bear/APT28/Sofacy while cautioning that similarity alone did not prove attribution.
CrowdStrike published reporting that linked Fancy Bear to an Android application used to track Ukrainian field artillery units. The references indicate this was a distinct public disclosure in the story, though no event date is explicitly anchored in the provided content.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
blog.crysys.hu
Open sourceblog.crysys.hu
Open sourcecrowdstrike.com
Open sourcecrowdstrike.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google and Mandiant disclosed **PROMPTSPY**, an Android backdoor that uses AI-enabled functions to support credential theft, persistence, and operator resilience. The malware can capture biometric authentication input, display deceptive overlays to hinder removal, and relaunch remotely through Firebase Cloud Messaging. Investigators said operators can update command-and-control infrastructure, Gemini API keys, and VNC relay servers without redeploying the payload, allowing the malware to adapt after installation. Google said it disabled infrastructure tied to the activity, found no PROMPTSPY-infected apps on Google Play, and confirmed that Google Play Protect detects known samples. The report also described a broader rise in adversarial use of large language models and agentic tooling across the intrusion lifecycle. Google linked a suspected **PRC-nexus** actor to the use of tools including `Hexstrike`, `Graphiti`, `Strix`, `subfinder`, and `httpx` while targeting a Japanese technology company and an East Asian cybersecurity platform. Separately, the company said information operation actors tied to Russia, Iran, China, and Saudi Arabia are using AI for content generation, localization, reconnaissance, phishing preparation, environmental fingerprinting, and more autonomous attack workflows, including suspected AI voice cloning in the pro-Russia **Operation Overload** campaign.
Jun 29, 2026
Researchers tied multiple Android threats to the **Ztorg** malware family, including trojanized apps such as **"Cool Video Player," "Magic browser,"** and **"Noise Detector"**. The malware used anti-analysis checks to avoid Android SDK emulators and common sandbox environments, then contacted command-and-control servers including `bbs.tihalf.com` and `alla.tihalf.com` with encrypted device data. In one infection chain, the app decrypted server responses, downloaded a secondary APK, decoded it, stored it as `dba.jar`, and loaded it invisibly with `DexClassLoader`, confirming a staged delivery model designed to hide malicious behavior from users and analysts. Separate Ztorg-linked samples distributed through Google Play were installed more than **60,000** times before removal and shifted monetization from rooting toward **premium SMS fraud** and likely **WAP billing abuse**, using IMSI-derived carrier data to tailor activity by country and operator. Other Ztorg payloads went further by lowering **SELinux** protections, attempting to root devices, replacing system binaries such as `/system/bin/debuggerd`, and silently installing additional apps and executables for persistence. Analysts said the family combined obfuscation, encrypted payload delivery, rooting components, and stealthy monetization modules, making infections difficult to detect and remove.
Aug 15, 2026
CISA and the UK National Cyber Security Centre published a joint malware analysis report on **Infamous Chisel**, an Android-focused malware family attributed to Russia’s military intelligence unit **GRU 85th Main Special Service Center (GTsSS), Unit 26165**. The malware was identified on Android tablets used by the Ukrainian military and is described as a collection of components that provide persistent access, periodic device scanning, file exfiltration, and traffic tunneling from compromised devices. The agencies said the capability appears designed primarily for **espionage**, enabling operators to harvest sensitive military information from infected devices. The report says Infamous Chisel can search directories and file types of operational interest, monitor network information, and use modules based on tools such as **Tor** and **SOCKS** to route traffic through infected Android devices. Analysts noted the malware was likely deployed through physical access or other compromise methods rather than broad app-store distribution, and assessed some code as poorly obfuscated and narrowly tailored to the operational environment. The publication provides technical indicators and defensive guidance to help organizations detect the malware, investigate Android device compromise, and reduce exposure to mobile espionage activity.
Jul 12, 2026