Loading story…
A new Android ransomware family tracked as Android/Filecoder.C was distributed through malicious posts on Reddit and the XDA Developers forum, then expanded its reach by sending SMS messages with malicious links to every contact on an infected device. After installation, the malware encrypted files on accessible storage, appended the .seven extension, and displayed a ransom note demanding payment in Bitcoin, typically between about US$94 and US$188.
The malware used an unusual hybrid encryption routine that generated per-file AES keys and protected them with an embedded RSA-1024 public key, leaving victims with no practical free decryption option. It also relied on hardcoded and dynamically retrieved infrastructure, including command-and-control details and Bitcoin wallet information fetched through Pastebin. Researchers said the campaign’s impact appeared limited because of narrow targeting and operational mistakes, but warned the same techniques could become far more dangerous if deployed at broader scale.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
ESET reported that the Android ransomware family Android/Filecoder.C had been active since at least July 12, 2019. The malware was distributed via malicious posts on Reddit and the XDA Developers forum and then propagated further by sending SMS messages with malicious links to victims' contacts.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported that the Android malware family **Xbot** evolved from a stealthy SMS-focused trojan into a broader banking and ransomware threat distributed through third-party app markets rather than Google Play. The malware masqueraded as trusted apps including **Google Play**, **Opera Browser**, **Android Market**, and **Minecraft**, then hid its launcher icon after installation to avoid detection. Early variants primarily targeted users in Russia and Eastern Europe, monitoring incoming SMS messages for selected keywords, exfiltrating messages to command-and-control infrastructure, sending premium-rate texts, downloading additional APKs, and persisting across reboots. Later analysis found Xbot embedded in 22 malicious apps and expanded to phishing **Google Play** payment details and login credentials for multiple banking apps, including major Australian banks and at least one Russian bank. The trojan used activity hijacking and **WebView** overlays to present fake login and card-entry screens, stole SMS messages and contacts, abused device administrator privileges, and accepted remote commands from its operators. Researchers also found ransomware functions that could lock the device, set a password, encrypt files on external storage with a simple XOR routine, and demand a **$100 PayPal My Cash Card** payment, while added obfuscation and dormant call-recording code indicated active ongoing development.
Aug 15, 2026
An Android ransomware family dubbed **CryCryptor** targeted users in Canada by impersonating an official COVID-19 contact-tracing application allegedly issued by Health Canada. The malware was distributed outside official app stores through spoofed domains including `covid19tracer[.]ca` and `tracershield[.]ca`, aligning with the mobile intrusion technique `T1476` for delivering malicious apps via other means. Once installed, it encrypted common file types on external storage and dropped ransom notes in affected directories. ESET found that CryCryptor used AES encryption with a randomly generated 16-character key and stored per-file salt and IV in separate files, but a flaw in its Android implementation exposed the decryption service through **CWE-926 Improper Export of Android Components**. That weakness allowed researchers to create and release a decryptor for victims. ESET also linked the malware to the open-source **CryDroid** ransomware code on GitHub, and the fake distribution domains were taken offline after notification to the Canadian Centre for Cyber Security.
Aug 15, 2026
Researchers identified **CryptoHost**, also tracked as **Manamecrypt**, as a ransomware family that did not truly encrypt files but instead moved targeted data into a password-protected **RAR** archive and demanded **0.33 Bitcoin** for recovery. The malware reportedly stored both the archive and its executable under `AppData\Roaming`, established persistence through a **Run** registry key, and verified exact ransom payments through **blockchain.info** before releasing files. It was also reported as being bundled with a **uTorrent** installer and detected by security products as **`Ransom:MSIL/Manamecrypt.A`** and **`Ransom_CRYPTOHOST.A`**. Analysis of the malware showed the archive password was generated predictably from the archive name and the victim username, allowing affected files to be recovered without paying the ransom. Researchers also said the threat attempted to frustrate remediation by deleting the **SafeBoot** registry key and terminating processes associated with security tools, administration, gaming, shopping, and social-media applications. While some reports described the attacks as highly disruptive for users and companies, they also warned that ransom payment via **Bitcoin** remained risky and offered no guarantee of successful recovery, reinforcing the need for preventive security controls and backups.
Aug 15, 2026