Loading story…
The StrongPity espionage group expanded beyond its established Windows malware operations by deploying Android backdoors for the first time, according to research linking the mobile samples to the actor through shared code structure, modular design, file collection behavior, and command-and-control infrastructure. The Android malware was distributed through repackaged legitimate applications, fake apps, and compromised websites, showing that the group was testing multiple infection paths while broadening its surveillance capability to mobile devices.
Researchers reported at least two Android trojan variants, with the newer version adding more message types, accessibility and notification components, SQLite-based local storage, service execution triggered by ScreenReceiver, and the ability to invoke root-level access via su on compromised devices. Infrastructure tied to domains such as upn-sec3-msd[.]com and networktopologymaps[.]com, along with earlier reporting on PROMETHIUM/StrongPity activity, indicates the group was extending its global reach while building modular tooling designed to collect victim data through downloadable components.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Trend Micro reported the first publicly documented use of malicious Android applications by StrongPity, attributing repackaged apps, fake apps, and compromised websites to the group based on code, behavior, and infrastructure overlaps with its Windows malware.
Cisco Talos published a report on PROMETHIUM's StrongPity activity, including infrastructure such as the domain hostoperationsystems[.]com that was later cited for overlap with the Android operation.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 43 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ESET reported that the **StrongPity** espionage group targeted Android users by distributing trojanized versions of legitimate messaging applications, including **Signal** and a modified **Telegram** build, through attacker-controlled websites that mimicked official download pages. The campaign relied on users sideloading the apps outside official stores, allowing the spyware to masquerade as functional software while gaining access to sensitive mobile data. Once installed, the Android malware could collect a wide range of information from infected devices, including SMS messages, call logs, contact lists, and stored files, and it could also record phone calls and ambient audio. The operation extended StrongPity’s long-running espionage activity from Windows into mobile platforms, underscoring the group’s focus on covert surveillance of individuals through fake app distribution and broad device-level data theft.
Jul 12, 2026
Researchers linked multiple campaigns to the **StrongPity** espionage group after attackers intercepted software downloads and replaced legitimate installers with trojanized packages. In one campaign, users searching for encryption and privacy tools such as **WinRAR** and **TrueCrypt** were redirected to malicious sites including `ralrab[.]com` and `true-crypt[.]com`, while compromised or abused distributor sites such as `winrar[.]be` and `winrar[.]it` helped deliver infected installers. The activity heavily affected users in **Italy, Belgium, and Turkey**, with additional victims across Europe, North Africa, and the Middle East. A later operation reused a **man-in-the-middle** delivery method previously associated with **FinFisher**, but served **Win32/StrongPity2** instead through an unusual HTTP redirect chain consistent with likely ISP-level interception. ESET reported code and operational overlaps with earlier StrongPity malware, including shared obfuscation, similar configuration structures, use of **libcurl 7.45**, and comparable file-exfiltration behavior. The malware deployed droppers, backdoors, keyloggers, and data stealers, and showed particular interest in systems running tools tied to encrypted communications, including **PuTTY**, **WinSCP**, **FileZilla**, `mstsc`, and **mRemoteNG**.
Aug 14, 2026
Google and Mandiant disclosed **PROMPTSPY**, an Android backdoor that uses AI-enabled functions to support credential theft, persistence, and operator resilience. The malware can capture biometric authentication input, display deceptive overlays to hinder removal, and relaunch remotely through Firebase Cloud Messaging. Investigators said operators can update command-and-control infrastructure, Gemini API keys, and VNC relay servers without redeploying the payload, allowing the malware to adapt after installation. Google said it disabled infrastructure tied to the activity, found no PROMPTSPY-infected apps on Google Play, and confirmed that Google Play Protect detects known samples. The report also described a broader rise in adversarial use of large language models and agentic tooling across the intrusion lifecycle. Google linked a suspected **PRC-nexus** actor to the use of tools including `Hexstrike`, `Graphiti`, `Strix`, `subfinder`, and `httpx` while targeting a Japanese technology company and an East Asian cybersecurity platform. Separately, the company said information operation actors tied to Russia, Iran, China, and Saudi Arabia are using AI for content generation, localization, reconnaissance, phishing preparation, environmental fingerprinting, and more autonomous attack workflows, including suspected AI voice cloning in the pro-Russia **Operation Overload** campaign.
Jun 29, 2026