auren-research/cyber-sec huggingface dataset:
modified: 2024-10-01T15:53:53.833Z
name: Exobot
description: [Exobot](https://attack.mitre.org/software/S0522) is Android banking malware, primarily targeting financial institutions in Germany, Austria, and France.(Citation: Threat Fabric Exobot)
is_family: yes
x_mitre_platforms: Android
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.0
x_mitre_aliases: Exobot
type: malware
spec_version: 2.1
id: malware--c91cec55-634c-4670-ba10-2dc7ceb28e98
created: 2020-10-29T13:32:20.972Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0522
external_id: S0522
source_name: Threat Fabric Exobot
description: Threat Fabric. (2017, February). Exobot - Android banking Trojan on the rise. Retrieved October 29, 2020.
url: https://www.threatfabric.com/blogs/exobot_android_banking_trojan_on_the_rise.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: malware
spec_version: 2.1
id: malware--ca4f63b9-a358-4214-bb26-8c912318cfde
created: 2017-10-25T14:48:44.540Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0286
external_id: S0286
source_name: OBAD
description: (Citation: TrendMicro-Obad)
source_name: TrendMicro-Obad
description: Veo Zhang. (2013, June 13). Cybercriminals Improve Android Malware Stealth Routines with OBAD. Retrieved December 9, 2016.
url: http://blog.trendmicro.com/trendlabs-security-intelligence/cybercriminals-improve-android-malware-stealth-routines-with-obad/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:40:40.325Z
name: OBAD
description: OBAD is an Android malware family. (Citation: TrendMicro-Obad)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
modified: 2025-03-12T22:09:42.623Z
name: FjordPhantom
description: [FjordPhantom](https://attack.mitre.org/software/S1208) is a malicious Android application first discovered in September 2024 with targets in Southeast Asia, specifically Indonesia, Thailand, and Vietnam. [FjordPhantom](https://attack.mitre.org/software/S1208) was distributed through email and messaging applications. Once installed, the application launches a virtualization solution to steal important information, such as bank accounts, and to manipulate the user interface. The malicious activity from the virtualization solution runs alongside legitimate banking applications.(Citation: Promon FjordPhantom Oct2024) 
is_family: yes
x_mitre_platforms: Android
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.0
x_mitre_contributors: Liran Ravich, CardinalOps
x_mitre_aliases: FjordPhantom
type: malware
spec_version: 2.1
id: malware--cfe91950-c01f-4e1f-ada1-7ac9b4f79fd4
created: 2025-03-12T22:01:15.599Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1208
external_id: S1208
source_name: Promon FjordPhantom Oct2024
description: Promon Security Research Team. (2024, October 1). Retrieved February 19, 2025.
url: https://promon.io/security-news/fjordphantom-android-malware
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: malware
spec_version: 2.1
id: malware--d05f7357-4cbe-47ea-bf83-b8604226d533
created: 2017-10-25T14:48:45.482Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0304
external_id: S0304
source_name: Android/Chuli.A
description: (Citation: Kaspersky-WUC)
source_name: Kaspersky-WUC
description: Costin Raiu, Denis Maslennikov, Kurt Baumgartner. (2013, March 26). Android Trojan Found in Targeted Attack. Retrieved December 23, 2016.
url: https://securelist.com/android-trojan-found-in-targeted-attack-58/35552/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:40:40.920Z
name: Android/Chuli.A
description: [Android/Chuli.A](https://attack.mitre.org/software/S0304) is Android malware that was delivered to activist groups via a spearphishing email with an attachment. (Citation: Kaspersky-WUC)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.2
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: Android/Chuli.A
type: malware
spec_version: 2.1
id: malware--d1c600f8-0fb6-4367-921b-85b71947d950
created: 2017-10-25T14:48:39.631Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0323
external_id: S0323
source_name: Charger
description: (Citation: CheckPoint-Charger)
source_name: CheckPoint-Charger
description: Oren Koriat and Andrey Polkovnichenko. (2017, January 24). Charger Malware Calls and Raises the Risk on Google Play. Retrieved January 24, 2017.
url: http://blog.checkpoint.com/2017/01/24/charger-malware/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:40:41.299Z
name: Charger
description: [Charger](https://attack.mitre.org/software/S0323) is Android malware that steals steals contacts and SMS messages from the user's device. It can also lock the device and demand ransom payment if it receives admin permissions. (Citation: CheckPoint-Charger)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: Charger
modified: 2024-11-17T18:11:27.761Z
name: Drinik
description: [Drinik](https://attack.mitre.org/software/S1054) is an evolving Android banking trojan that was observed targeting customers of around 27 banks in India in August 2021. Initially seen as an SMS stealer in 2016, [Drinik](https://attack.mitre.org/software/S1054) resurfaced as a banking trojan with more advanced capabilities included in subsequent versions between September 2021 and August 2022.(Citation: cyble_drinik_1022)
is_family: yes
x_mitre_platforms: Android
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.0
x_mitre_aliases: Drinik
type: malware
spec_version: 2.1
id: malware--d6e009b7-df5e-447a-bfd2-d5b77374edfe
created: 2023-01-18T19:05:43.194Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1054
external_id: S1054
source_name: cyble_drinik_1022
description: Cyble. (2022, October 27). Drinik Malware Returns With Advanced Capabilities Targeting Indian Taxpayers. Retrieved November 17, 2024.
url: https://web.archive.org/web/20221114031945/https://blog.cyble.com/2022/10/27/drinik-malware-returns-with-advanced-capabilities-targeting-indian-taxpayers/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: malware
spec_version: 2.1
id: malware--d89c132d-7752-4c7f-9372-954a71522985
created: 2017-10-25T14:48:46.734Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0308
external_id: S0308
source_name: Trojan-SMS.AndroidOS.OpFake.a
description: (Citation: Kaspersky-MobileMalware)
source_name: Kaspersky-MobileMalware
description: Roman Unuchek and Victor Chebyshev. (2014, February 24). Mobile Malware Evolution: 2013. Retrieved December 22, 2016.
url: https://securelist.com/mobile-malware-evolution-2013/58335/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:40:41.844Z
name: Trojan-SMS.AndroidOS.OpFake.a
description: [Trojan-SMS.AndroidOS.OpFake.a](https://attack.mitre.org/software/S0308) is Android malware. (Citation: Kaspersky-MobileMalware)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: malware
spec_version: 2.1
id: malware--d9e07aea-baad-4b68-bdca-90c77647d7f9
created: 2017-10-25T14:48:42.661Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0297
external_id: S0297
source_name: XcodeGhost
description: (Citation: PaloAlto-XcodeGhost1) (Citation: PaloAlto-XcodeGhost)
source_name: PaloAlto-XcodeGhost1
description: Claud Xiao. (2015, September 17). Novel Malware XcodeGhost Modifies Xcode, Infects Apple iOS Apps and Hits App Store. Retrieved December 21, 2016.
url: http://researchcenter.paloaltonetworks.com/2015/09/novel-malware-xcodeghost-modifies-xcode-infects-apple-ios-apps-and-hits-app-store/
source_name: PaloAlto-XcodeGhost
description: Claud Xiao. (2015, September 18). Update: XcodeGhost Attacker Can Phish Passwords and Open URLs through Infected Apps. Retrieved December 21, 2016.
url: http://researchcenter.paloaltonetworks.com/2015/09/update-xcodeghost-attacker-can-phish-passwords-and-open-urls-though-infected-apps/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:40:42.212Z
name: XcodeGhost
description: [XcodeGhost](https://attack.mitre.org/software/S0297) is iOS malware that infected at least 39 iOS apps in 2015 and potentially affected millions of users. (Citation: PaloAlto-XcodeGhost1) (Citation: PaloAlto-XcodeGhost)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: malware
spec_version: 2.1
id: malware--ddbe5657-e21e-4a89-8221-2f1362d397ec
created: 2020-12-24T21:41:36.719Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0549
external_id: S0549
source_name: Lookout Uyghur Campaign
description: A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.
url: https://www.lookout.com/documents/threat-reports/us/lookout-uyghur-malware-tr-us.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:40:42.577Z
name: SilkBean
description: [SilkBean](https://attack.mitre.org/software/S0549) is a piece of Android surveillanceware containing comprehensive remote access tool (RAT) functionality that has been used in targeting of the Uyghur ethnic group.(Citation: Lookout Uyghur Campaign)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: SilkBean
type: malware
spec_version: 2.1
id: malware--dfdac962-9461-47f0-a212-36dfce2a97e6
created: 2020-07-20T13:27:33.113Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0489
external_id: S0489
source_name: Talos-WolfRAT
description: W. Mercer, P. Rascagneres, V. Ventura. (2020, May 19). The wolf is back... . Retrieved July 20, 2020.
url: https://blog.talosintelligence.com/2020/05/the-wolf-is-back.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:40:42.935Z
name: WolfRAT
description: [WolfRAT](https://attack.mitre.org/software/S0489) is malware based on a leaked version of [Dendroid](https://attack.mitre.org/software/S0301) that has primarily targeted Thai users. [WolfRAT](https://attack.mitre.org/software/S0489) has most likely been operated by the now defunct organization Wolf Research.(Citation: Talos-WolfRAT) 
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: WolfRAT
type: malware
spec_version: 2.1
id: malware--e110f94a-e2c5-4f5f-ba78-9c2ab6d2d9e4
created: 2021-10-01T14:42:48.234Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0655
external_id: S0655
source_name: SecureList BusyGasper
description: Alexey Firsh. (2018, August 29). BusyGasper – the unfriendly spy. Retrieved October 1, 2021.
url: https://securelist.com/busygasper-the-unfriendly-spy/87627/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T21:22:15.058Z
name: BusyGasper
description: [BusyGasper](https://attack.mitre.org/software/S0655) is Android spyware that has been in use since May 2016. There have been less than 10 victims, all who appear to be located in Russia, that were all infected via physical access to the device.(Citation: SecureList BusyGasper)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: BusyGasper
type: malware
spec_version: 2.1
id: malware--e13d084c-382f-40fd-aa9a-98d69e20301e
created: 2017-10-25T14:48:47.674Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0293
external_id: S0293
source_name: CheckPoint-BrainTest
description: Andrey Polkovnichenko and Alon Boxiner. (2015, September 21). BrainTest – A New Level of Sophistication in Mobile Malware. Retrieved December 21, 2016.
url: http://blog.checkpoint.com/2015/09/21/braintest-a-new-level-of-sophistication-in-mobile-malware/
source_name: Lookout-BrainTest
description: Chris Dehghanpoor. (2016, January 6). Brain Test re-emerges: 13 apps found in Google Play Read more: Brain Test re-emerges: 13 apps found in Google Play. Retrieved December 21, 2016.
url: https://blog.lookout.com/blog/2016/01/06/brain-test-re-emerges/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T21:22:15.215Z
name: BrainTest
description: [BrainTest](https://attack.mitre.org/software/S0293) is a family of Android malware. (Citation: CheckPoint-BrainTest) (Citation: Lookout-BrainTest)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: malware
spec_version: 2.1
id: malware--e296b110-46d3-4f7a-894c-cc71ea50168c
created: 2020-12-18T20:14:46.858Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0545
external_id: S0545
source_name: WhiteOps TERRACOTTA
description: Satori Threat Intelligence and Research Team. (2020, August). TERRACOTTA Android Malware: A Technical Study. Retrieved December 18, 2020.
url: https://www.whiteops.com/blog/terracotta-android-malware-a-technical-study
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:40:43.667Z
name: TERRACOTTA
description: [TERRACOTTA](https://attack.mitre.org/software/S0545) is an ad fraud botnet that has been capable of generating over 2 billion fraudulent requests per week.(Citation: WhiteOps TERRACOTTA)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: TERRACOTTA
modified: 2023-10-11T14:36:10.445Z
name: Escobar
description: [Escobar](https://attack.mitre.org/software/S1092) is an Android banking trojan, first detected in March 2021, believed to be a new variant of AbereBot.(Citation: Bleeipng Computer Escobar)
is_family: yes
x_mitre_platforms: Android
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.0
x_mitre_contributors: Pooja Natarajan, NEC Corporation India
Hiroki Nagahama, NEC Corporation
Manikantan Srinivasan, NEC Corporation India
x_mitre_aliases: Escobar
type: malware
spec_version: 2.1
id: malware--ec13d292-6d8d-4c7a-b07c-a2bd2402569a
created: 2023-09-28T17:04:46.516Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1092
external_id: S1092
source_name: Bleeipng Computer Escobar
description: B. Toulas. (2022, March 12). Android malware Escobar steals your Google Authenticator MFA codes. Retrieved September 28, 2023.
url: https://www.bleepingcomputer.com/news/security/android-malware-escobar-steals-your-google-authenticator-mfa-codes/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2025-03-27T14:28:40.768Z
name: Android/SpyAgent
description: [Android/SpyAgent](https://attack.mitre.org/software/S1214) is a variant of spyware in the MoqHao phishing campaign primarily targeting Korean and Japanese users.(Citation: McAfee MoqHao 2019) Fake security applications were used to target Japanese users, while fake police applications were used to target Korean users. Both fake applications have common C2 commands and share the same crash report key on a cloud service.(Citation: McAfee MoqHao 2019)
is_family: yes
x_mitre_platforms: Android
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.0
x_mitre_aliases: Android/SpyAgent
type: malware
spec_version: 2.1
id: malware--f082d7dd-20a9-4157-93c0-75e7aea09e42
created: 2025-03-24T14:50:29.875Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1214
external_id: S1214
source_name: McAfee MoqHao 2019
description: Pak, C. (2019, August 7). MoqHao Related Android Spyware Targeting Japan and Korea Found on Google Play. Retrieved November 13, 2024.
url: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/moqhao-related-android-spyware-targeting-japan-and-korea-found-on-google-play/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: malware
spec_version: 2.1
id: malware--f082fc59-0317-49cf-971f-a1b6296ebb52
created: 2019-07-16T14:33:12.034Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0424
external_id: S0424
source_name: Kaspersky Triada March 2016
description: Snow, J. (2016, March 3). Triada: organized crime on Android. Retrieved July 16, 2019.
url: https://www.kaspersky.com/blog/triada-trojan/11481/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:40:44.380Z
name: Triada
description: [Triada](https://attack.mitre.org/software/S0424) was first reported in 2016 as a second stage malware. Later versions in 2019 appeared with new techniques and as an initial downloader of other Trojan apps.(Citation: Kaspersky Triada March 2016)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: Triada
type: malware
spec_version: 2.1
id: malware--f3975cc0-72bc-4308-836e-ac701b83860e
created: 2020-11-20T15:44:57.339Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0535
external_id: S0535
source_name: Symantec GoldenCup
description: R. Iarchy, E. Rynkowski. (2018, July 5). GoldenCup: New Cyber Threat Targeting World Cup Fans. Retrieved October 29, 2020.
url: https://symantec-enterprise-blogs.security.com/blogs/expert-perspectives/goldencup-new-cyber-threat-targeting-world-cup-fans
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:40:44.740Z
name: Golden Cup
description: [Golden Cup](https://attack.mitre.org/software/S0535) is Android spyware that has been used to target World Cup fans.(Citation: Symantec GoldenCup) 
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: Golden Cup
modified: 2025-03-27T22:35:44.281Z
name: FluBot
description: [FluBot](https://attack.mitre.org/software/S1067) is a multi-purpose mobile banking malware that was first observed in Spain in late 2020. It primarily spread through European countries using a variety of SMS phishing messages in multiple languages.(Citation: proofpoint_flubot_0421)(Citation: bitdefender_flubot_0524) An international law enforcement operation of 11 countries eventually disrupted the spread of [FluBot](https://attack.mitre.org/software/S1067).(Citation: Europol FluBot Jun2022)
is_family: yes
x_mitre_platforms: Android
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.1
x_mitre_aliases: FluBot
type: malware
spec_version: 2.1
id: malware--f5ff006c-702f-4ded-8e60-ca6c540d91bc
created: 2023-02-28T20:25:59.034Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1067
external_id: S1067
source_name: proofpoint_flubot_0421
description: Crista Giering, F. Naves, Andrew Conway, Adam McNeil . (2021, April 27). FluBot Android Malware Spreading Rapidly Through Europe, May Hit U.S. Soon. Retrieved February 28, 2023.
url: https://www.proofpoint.com/us/blog/threat-insight/flubot-android-malware-spreading-rapidly-through-europe-may-hit-us-soon
source_name: Europol FluBot Jun2022
description: Europol. (2022, June 1). Takedown of SMS-based FluBot spyware infecting Android phones. Retrieved April 18, 2024.
url: https://www.europol.europa.eu/media-press/newsroom/news/takedown-of-sms-based-flubot-spyware-infecting-android-phones
source_name: bitdefender_flubot_0524
description: Filip TRUȚĂ, Răzvan GOSA, Adrian Mihai GOZOB. (2022, May 24). New FluBot Campaign Sweeps through Europe Targeting Android and iOS Users Alike. Retrieved February 28, 2023.
url: https://www.bitdefender.com/blog/labs/new-flubot-campaign-sweeps-through-europe-targeting-android-and-ios-users-alike/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5