Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

CVE Database V5

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

The Hacker News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit NetSec

Reddit InfoSec News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The Godfather Trojan is a high-severity mobile malware threat that delivers malicious applications via authorized app stores and exfiltrates data over command-and-control (C2) channels. It targets mobile phones and uses stealthy techniques to avoid detection by masquerading as legitimate apps. Although no patches or known exploits in the wild are currently reported, the Trojan's capability to deliver payloads through trusted sources and perform data exfiltration poses significant risks. European organizations with mobile device usage are at risk, especially those in countries with high mobile penetration and strategic sectors such as finance and government. Mitigation requires enhanced mobile app vetting, network monitoring for unusual C2 traffic, and user awareness to detect suspicious app behaviors. Countries like Germany, France, the UK, Italy, and Spain are most likely affected due to their large mobile user bases and critical infrastructure. Given the ease of delivery via authorized app stores and the potential for data loss, the threat severity is assessed as high. Defenders should prioritize detection of malicious apps in official stores and monitor network exfiltration channels to mitigate impact.

The Godfather Trojan is a mobile malware threat identified through open-source intelligence (OSINT) feeds, characterized by its delivery method and data exfiltration capabilities. It leverages the tactic of delivering malicious applications via authorized app stores (MITRE ATT&CK T1475), which allows it to bypass traditional security controls that rely on app source reputation. Once installed on a mobile device, the Trojan establishes a command-and-control (C2) channel to exfiltrate sensitive data (MITRE ATT&CK T1646). The malware targets mobile phones, exploiting the trust users place in official app stores to propagate. Although no specific affected versions or patches are noted, the Trojan's persistence and stealth make it a perpetual threat. The lack of known exploits in the wild suggests it may be in early stages or under limited deployment, but the high severity rating indicates significant potential impact. Indicators of compromise (IOCs) are not provided, which complicates detection efforts. The Trojan's ability to operate covertly within authorized app ecosystems and communicate over C2 channels underscores the sophistication of this threat and the challenges in defending against it.

%KEY% is the key sent as a parameter in the requests mentioned above. %LOCALE% is the system language. The user-agent used when the request is executed is:

Detailed information about OSINT - Godfather Trojan IOCs. Get real-time updates, technical details, and mitigation strategies.

OSINT - Godfather Trojan IOCs - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Godfather Trojan IOCs

The Godfather Trojan campaign represents a high-severity mobile malware threat primarily targeting mobile phones through the delivery of malicious applications via authorized app stores, as indicated by the MITRE ATT&CK pattern T1475. This technique involves attackers circumventing typical app store security measures to distribute malware under the guise of legitimate applications, increasing the likelihood of user installation without suspicion. Once installed, the Trojan establishes command and control (C2) channels to exfiltrate sensitive data, consistent with the MITRE ATT&CK pattern T1646, which describes data exfiltration over C2 channels. The campaign is characterized by perpetual OSINT indicators of compromise (IOCs), although the certainty of these indicators is moderate (50%), suggesting ongoing monitoring and analysis are required to confirm active exploitation. No patches or direct fixes are available, and no known exploits in the wild have been confirmed, indicating that the threat relies on social engineering and app store infiltration rather than exploiting software vulnerabilities. The Trojan’s capability to stealthily deliver payloads and exfiltrate data over network channels poses significant risks to confidentiality and integrity of mobile device data. The absence of authentication requirements for exploitation (since the user must install the app) and the lack of need for further user interaction after installation make this threat particularly insidious. Given the mobile phone asset variety targeted, this campaign can impact a broad range of users and organizations relying on mobile devices for sensitive communications and operations.

Title	Severity	Type	Source	Date

Threats Tagged 'veris:asset:variety="u - mobile phone"'

Stop chasing alerts. Route them.

Filter Threats