Threat video1:00
Glitch SPY Android RAT and Tutaj Dom Rental Lure
Glitch SPY RAT arrives via a fake Polish rental site, dropped by Brokewell. 9 detection rules, 20 IOCs, 22 ATT&CK techniques and a free Splunk SPL rule.
Read the full threat intel for Glitch SPY Android RAT and Tutaj Dom Rental Lure →
Chapters
- 0:00The hookGlitch SPY supports 70+ commands.
- 0:04The storyVictims download from a fake Polish rental app.
- 0:10Attack pathPhishing leads to download from a fake Polish rental site.
- 0:25AttributionAttributed to Baron Samedit Marais.
- 0:30Indicators of compromise8 indicators to hunt: 3 domains, 1 URL and 2 SHA-256 hashes, and more.
- 0:39MITRE ATT&CK techniques22 ATT&CK techniques, from initial access to impact.
- 0:43Remediation5 steps now: Block and sinkhole the identified.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Glitch SPY supports 70+ commands.
0:05Victims download from a fake Polish rental app.
0:10Phishing leads to download from a fake Polish rental site.
0:14Victim sideloads Tutajdom.apk, grants Accessibility Service permissions.
0:19Glitch SPY connects to C2, begins exfiltrating data.
0:26Attributed to Baron Samedit Marais. Confidence: low.
0:318 indicators to hunt: 3 domains, 1 URL and 2 SHA-256 hashes, and more.
0:3922 ATT&CK techniques, from initial access to impact.
0:445 steps now: Block and sinkhole the identified.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.