Loading threat actor…
GhostBat RAT operators are cybercriminals associated with Android malware campaigns using the GhostBat remote access trojan to target mobile users. Reported activity includes targeting Indian Android users through bogus mobile applications distributed via WhatsApp and SMS messages that direct victims to compromised websites and GitHub-hosted content. GhostBat has been described as an Android RAT capable of data theft, phishing, and remote interactive access including VNC-style sessions, indicating post-compromise control of infected devices. Based on the observed delivery methods and malware functionality, the operators demonstrate mobile-focused initial access through social engineering, credential and data theft, and broader post-exploitation capability on compromised Android endpoints. Attribution to a specific named group or country is not currently available.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.