Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The Godfather Trojan is a malware threat primarily targeting mobile phones, as indicated by the asset variety tag. This Trojan is notable for its delivery method, which involves distributing malicious applications via authorized app stores (MITRE ATT&CK technique T1475). This approach allows the malware to bypass some traditional security controls by masquerading as legitimate software, increasing the likelihood of user installation. Once installed, the Godfather Trojan establishes command and control (C2) communications to exfiltrate data, leveraging covert channels to avoid detection (MITRE ATT&CK technique T1646). The malware's capabilities include stealthy data theft and persistent presence on the infected device, posing significant risks to confidentiality and user privacy. The threat intelligence is sourced from CIRCL OSINT feeds and is tagged with a 50% certainty level, indicating moderate confidence in the reported indicators and behaviors. No patches or direct remediation links are available, and there are no known exploits in the wild at the time of reporting. The Trojan's persistence and method of delivery make it a notable concern for mobile device security, especially given the widespread use of mobile phones in both personal and professional contexts. The lack of specific indicators of compromise (IOCs) in the provided data suggests that detection may rely heavily on behavioral analysis and monitoring of network traffic for suspicious C2 communications.

%KEY% is the key sent as a parameter in the requests mentioned above. %LOCALE% is the system language. The user-agent used when the request is executed is:

Detailed information about OSINT - Godfather Trojan IOCs. Get real-time updates, technical details, and mitigation strategies.

OSINT - Godfather Trojan IOCs - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Godfather Trojan IOCs

The Godfather Trojan campaign represents a high-severity mobile malware threat primarily targeting mobile phones through the delivery of malicious applications via authorized app stores, as indicated by the MITRE ATT&CK pattern T1475. This technique involves attackers circumventing typical app store security measures to distribute malware under the guise of legitimate applications, increasing the likelihood of user installation without suspicion. Once installed, the Trojan establishes command and control (C2) channels to exfiltrate sensitive data, consistent with the MITRE ATT&CK pattern T1646, which describes data exfiltration over C2 channels. The campaign is characterized by perpetual OSINT indicators of compromise (IOCs), although the certainty of these indicators is moderate (50%), suggesting ongoing monitoring and analysis are required to confirm active exploitation. No patches or direct fixes are available, and no known exploits in the wild have been confirmed, indicating that the threat relies on social engineering and app store infiltration rather than exploiting software vulnerabilities. The Trojan’s capability to stealthily deliver payloads and exfiltrate data over network channels poses significant risks to confidentiality and integrity of mobile device data. The absence of authentication requirements for exploitation (since the user must install the app) and the lack of need for further user interaction after installation make this threat particularly insidious. Given the mobile phone asset variety targeted, this campaign can impact a broad range of users and organizations relying on mobile devices for sensitive communications and operations.

Spyware Telegram mod distributed via Google Play - Evil Telegram doppelganger attacks Chinese users

This threat involves a spyware campaign leveraging a maliciously modified version of the Telegram messaging application, distributed via the official Google Play Store. The threat actor created a doppelganger or fake Telegram client targeting primarily Chinese users. By masquerading as a legitimate Telegram mod, the spyware app bypassed typical app store security checks and gained distribution through a trusted platform, increasing the likelihood of user installation. Once installed, the spyware likely performs data manipulation activities, potentially intercepting, exfiltrating, or altering user communications and data. The campaign is characterized by the delivery of a malicious app through an authorized app store (MITRE ATT&CK T1475), which is a sophisticated attack vector as it exploits user trust in official distribution channels. The targeting of Chinese users suggests a focus on a specific demographic or geopolitical interest, possibly to surveil or disrupt communications within or related to China. Although the severity is rated as low by the source, the presence of spyware in a widely used messaging platform can have significant privacy and security implications. The technical details indicate a moderate threat level (3) and analysis confidence (2), but no known exploits in the wild have been reported beyond this campaign. The lack of affected versions and patch links suggests this is a campaign-specific threat rather than a vulnerability in Telegram itself.

Detailed information about Spyware Telegram mod distributed via Google Play - Evil Telegram doppelganger attacks Chinese users. Get real-time updates, technical

Spyware Telegram mod distributed via Google Play - Evil Telegram doppelganger attacks Chinese users - Live Threat Intelligence - Threat Radar | OffSeq.com

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="deliver malicious app via authorized app store - t1475"'

Filter Threats