Threat video1:00
BTMob Android RAT Leak Expands Access: Detection & IOCs
Leaked BTMob source code lets independent actors modify and resell this Android RAT; hunt it with 9 detection rules, 21 IOCs and a free Splunk SPL rule.
Read the full threat intel for BTMob Android RAT Leak Expands Access: Detection & IOCs →
Chapters
- 0:00The hookSource code leaked; about 1,400 C2 exposed.
- 0:04The storyPublicly analyzed in February 2025.
- 0:11Attack pathPhishing pages target banking apps; users sideload malware.
- 0:28AttributionAttributed to EVLF.
- 0:32Indicators of compromise11 indicators to hunt: 1 IP, 5 domains and 2 URLs, and more.
- 0:39MITRE ATT&CK techniques16 ATT&CK techniques, from initial access to exfiltration.
- 0:44Remediation3 steps now: Block the network IOCs listed for this threat and alert.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Source code leaked; about 1,400 C2 exposed.
0:05Publicly analyzed in February 2025.
0:08Then February 2026, source leaked.
0:12Phishing pages target banking apps; users sideload malware.
0:16Accessibility abuse steals credentials and records screens.
0:20Camera, microphone, and GPS feed the operator.
0:23Collected data streams to the operator server.
0:28Attributed to EVLF. Confidence: medium.
0:3311 indicators to hunt: 1 IP, 5 domains and 2 URLs, and more.
0:3916 ATT&CK techniques, from initial access to exfiltration.
0:443 steps now: Block the network IOCs listed for this threat and alert.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.