Loading story…
An Android ransomware family dubbed CryCryptor targeted users in Canada by impersonating an official COVID-19 contact-tracing application allegedly issued by Health Canada. The malware was distributed outside official app stores through spoofed domains including covid19tracer[.]ca and tracershield[.]ca, aligning with the mobile intrusion technique T1476 for delivering malicious apps via other means. Once installed, it encrypted common file types on external storage and dropped ransom notes in affected directories.
ESET found that CryCryptor used AES encryption with a randomly generated 16-character key and stored per-file salt and IV in separate files, but a flaw in its Android implementation exposed the decryption service through CWE-926 Improper Export of Android Components. That weakness allowed researchers to create and release a decryptor for victims. ESET also linked the malware to the open-source CryDroid ransomware code on GitHub, and the fake distribution domains were taken offline after notification to the Canadian Centre for Cyber Security.
Get the infrastructure and lures behind it.
8 events from the most recent confirmed update back to the earliest known activity.
The two malicious domains distributing CryCryptor stopped responding. This occurred after notification to the Canadian Centre for Cyber Security.
ESET reported the CryCryptor threat to the Canadian Centre for Cyber Security. The campaign involved Android ransomware distributed through fake COVID-19 tracing websites.
A second malicious distribution domain for the fake tracing app was registered. ESET identified the campaign domains as covid19tracer[.]ca and tracershield[.]ca.
The malicious Android ransomware sample was compiled, based on its certificate metadata. This sample masqueraded as a Health Canada COVID-19 contact-tracing app.
The first malicious domain used to distribute the fake COVID-19 tracing app was registered. ESET identified it as part of the CryCryptor campaign targeting users in Canada.
A sample of the CryDroid code appeared on VirusTotal the same day the GitHub code was published. This provided an early public trace of the ransomware code later tied to CryCryptor.
Open-source Android ransomware code named CryDroid version 1.1 was published on GitHub. ESET later linked CryCryptor to this codebase.
ESET disclosed that CryCryptor targeted users in Canada by posing as a Health Canada COVID-19 tracing app and said it had built a decryptor by exploiting an exposed decryption service in the malware. The decryptor was stated to work only on that specific CryCryptor version.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new Android ransomware family tracked as **Android/Filecoder.C** was distributed through malicious posts on **Reddit** and the **XDA Developers** forum, then expanded its reach by sending SMS messages with malicious links to every contact on an infected device. After installation, the malware encrypted files on accessible storage, appended the `.seven` extension, and displayed a ransom note demanding payment in Bitcoin, typically between about **US$94 and US$188**. The malware used an unusual hybrid encryption routine that generated per-file **AES** keys and protected them with an embedded **RSA-1024** public key, leaving victims with no practical free decryption option. It also relied on hardcoded and dynamically retrieved infrastructure, including command-and-control details and Bitcoin wallet information fetched through **Pastebin**. Researchers said the campaign’s impact appeared limited because of narrow targeting and operational mistakes, but warned the same techniques could become far more dangerous if deployed at broader scale.
Aug 14, 2026
Threat actors used **COVID-19-themed lures** to push Android malware through SMS phishing and unofficial download sites, targeting users with fake alerts, safety tools, and public-health claims. Proofpoint reported that the **TangleBot** campaign sent text messages in the United States and Canada themed around coronavirus information and power outages, directing Android users to links that served a malicious APK and a fake **Adobe Flash Player** update prompt. Separately, researchers documented a fake **"Corona Safety Mask"** app and similar coronavirus-themed Android packages that were distributed outside official app stores and promoted through deceptive websites and messages. Once installed, the malware gave operators extensive access to infected devices. TangleBot supported surveillance and device control features including **keylogging, SMS and call control, screen capture, camera and microphone access, GPS tracking, clipboard access, and overlay injection**, while using obfuscation and Telegram-based command-and-control discovery to hinder analysis. The other Android trojan focused on propagation by requesting permission to read contacts and send SMS messages, harvesting address books and sending malicious texts with download links to additional victims; researchers also warned the app appeared capable of evolving toward broader fraud or theft functions.
Aug 15, 2026
The **Cryakl** ransomware family, also known as **Fantomas**, **Crykal**, and later **CryLock**, developed from early spam-driven attacks into a broader ransomware operation that encrypted files without needing live command-and-control communication and increasingly relied on affiliate-style distribution. Early campaigns targeted victims primarily in Russia, with additional activity in Germany, Kazakhstan, Ukraine, Belarus, Japan, and Italy, using phishing emails and malicious archives to deliver Delphi-based malware that encrypted portions of files, stored metadata locally, persisted through Windows registry keys, and in some cases installed the password-stealing trojan **`Trojan-PSW.Win32.Ruftar`** alongside the ransomware. Researchers also documented versions that used layered encryption with locally generated keys and hardcoded remote RSA public keys, allowing attackers to extort victims without any online key exchange. The operation later adopted tactics associated with modern **double extortion**. Deutsche Telekom linked at least one intrusion to a CryLock affiliate that encrypted a victim environment, displayed a pre-login legal warning, and threatened to publish stolen data through the **LOCKDATA Auction** leak marketplace, underscoring the shift from pure encryption to data-theft coercion. Separately, Belgian police seized Cryakl command-and-control servers and obtained private keys that enabled Kaspersky to expand decryption support in **RakhniDecryptor**, helping victims recover files from several Cryakl variants and disrupting one of the more prominent ransomware families active in Russia.
Aug 15, 2026