Loading threat actor…
TrickyWonders is a financially motivated cybercriminal group associated with Android malware operations targeting users in Uzbekistan. The group is known for operating the Wonderland Android SMS stealer, formerly known as WretchedCat, and for using related dropper families including MidnightDat and RoundRift to conceal and deliver encrypted payloads. TrickyWonders has also been linked to broader Uzbekistan-focused Android banking and credential theft activity alongside other regional threat groups such as Ajina and Blazefang. The group appears to use a hierarchical, profit-driven structure with owners and core developers maintaining malware code and command-and-control infrastructure, while affiliates or workers distribute malicious applications in exchange for a share of stolen proceeds. Telegram is a central operational platform for coordination and distribution. TrickyWonders commonly relies on social engineering, fake application themes, messaging-based lures, and sideloaded Android APKs masquerading as legitimate software or updates. The actor tailors lures to local language, culture, and current events, including financial aid themes, to improve infection rates. TrickyWonders' malware is designed to steal SMS messages, including one-time passwords used for banking and authentication, hijack Telegram accounts by intercepting authentication codes, collect phone numbers and contact lists, suppress notifications, and support unauthorized financial transactions. Wonderland supports bidirectional real-time command-and-control, enabling remote tasking such as SMS theft and USSD-based actions. The group also abuses compromised Telegram accounts to message victims' contacts and propagate malware further, giving the operation a self-spreading component through trusted social relationships. Operationally, TrickyWonders demonstrates mature defense-evasion tradecraft on Android. Its droppers and payloads use heavy obfuscation, anti-analysis measures, and rapidly changing infrastructure and package naming to complicate detection and blacklisting. The shift from directly distributing stealers to using seemingly benign droppers reflects increased sophistication and an effort to bypass standard security checks. Monetization is centered on banking fraud and the resale or abuse of compromised Telegram access.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
5 malware families attributed to this actor across reporting.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
TrickyWonders is a threat actor group targeting Uzbekistan with Android banking trojans for financial theft.
TrickyWonders is orchestrating a large-scale, financially motivated Android malware campaign targeting users in Uzbekistan and Central Asia. They use an affiliate model to distribute advanced SMS stealer malware (Wonderland), focusing on banking fraud, SMS-based authentication bypass, and resale of compromised Telegram sessions.
TrickyWonders is conducting financially motivated mobile malware campaigns targeting users in Uzbekistan, using sophisticated Android droppers to deliver the Wonderland SMS stealer and steal funds from victims' bank cards.
Part of a set of threat groups targeting Telegram users in Uzbekistan with Android SMS-stealer campaigns delivered via sideloaded APKs and Telegram-based propagation to steal credentials and money.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.