Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

CVE Database V5

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

OSINT - Trojan downloader found on Google Play by @Maler360

This threat concerns a Trojan downloader malware identified on the Google Play Store, as reported by the security researcher @Maler360 and documented by CIRCL under the ms-caro-malware project. A Trojan downloader is a type of malicious software designed to infiltrate a device and subsequently download additional malicious payloads, potentially leading to further compromise. The malware was discovered in 2019 and classified as a Trojan, indicating its capability to masquerade as legitimate software while performing unauthorized actions. Although specific affected versions or targeted applications are not detailed, the presence on Google Play suggests that the malware was distributed through seemingly legitimate Android applications, exploiting the trust users place in the official app store. The threat level is indicated as 3 (on an unspecified scale), and the severity is marked as low, with a 50% certainty rating, implying moderate confidence in the threat's impact or prevalence. No known exploits in the wild have been reported, and no technical indicators or patches are provided, limiting detailed technical analysis. However, the nature of Trojan downloaders typically involves initial infection vectors that bypass user suspicion, followed by downloading and executing additional malicious components, which can lead to data theft, device control, or further malware propagation.

Detailed information about OSINT - Trojan downloader found on Google Play by @Maler360. Get real-time updates, technical details, and mitigation strategies.

OSINT - Trojan downloader found on Google Play by @Maler360 - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - DarkHydrus delivers new Trojan that can use Google Drive for C2 communications

The DarkHydrus threat actor group has been observed delivering a new Trojan malware variant known as RogueRobin, which uniquely leverages Google Drive as a command and control (C2) communication channel. This Trojan is part of the DarkHydrus intrusion set (G0079) and is designed to evade traditional network detection by using a legitimate cloud storage service for C2 operations. By abusing Google Drive, the malware can receive commands and exfiltrate data covertly, blending malicious traffic with normal user activity. This technique complicates detection and mitigation efforts since traffic to Google Drive is typically allowed and trusted within enterprise environments. The Trojan’s use of Google Drive for C2 communications indicates a sophisticated approach to persistence and stealth, enabling the threat actor to maintain long-term access to compromised systems. Although the reported severity is low and no known exploits in the wild have been documented, the malware’s capability to utilize a widely trusted cloud platform for malicious purposes represents a notable evolution in attacker tactics. The certainty of this intelligence is moderate (50%), and the threat level is assessed at 3 on a scale that likely ranges higher, suggesting limited but credible risk. The Trojan is categorized as malicious code with no specific affected versions or patches available, indicating it may target a broad range of systems without exploiting a particular vulnerability. The use of OSINT and MISP galaxy tags links this malware to the RogueRobin family and the DarkHydrus actor, both known for targeted espionage campaigns primarily in the Middle East but with potential global reach.

Detailed information about OSINT - DarkHydrus delivers new Trojan that can use Google Drive for C2 communications. Get real-time updates, technical details, and

Title	Severity	Type	Source	Date

Threats Tagged 'ecsirt:malicious-code="trojan"'

Filter Threats