Loading threat actor…
Ajina is a financially motivated cybercriminal threat actor associated with Android banking-trojan and SMS-stealer activity targeting users in Uzbekistan. It has been identified as one of the principal groups involved in a broader Uzbekistan-focused mobile malware ecosystem alongside TrickyWonders and Blazefang. Ajina is linked to the use of Android malware including Ajina.Banker and has participated in campaigns that rely heavily on Telegram-centric social engineering to infect victims and spread malicious applications through trusted contacts. The actor’s operations focus on compromising Android devices, obtaining access to victims’ phone numbers and Telegram accounts, and stealing money and credentials from infected phones. Campaigns attributed to Ajina have used sideloaded Android applications disguised as legitimate software, including fake utility or platform-branded apps, as well as droppers that conceal embedded payloads to evade detection. Once installed, the malware can request extensive permissions, interfere with removal attempts through deceptive prompts, and support repeated financial theft from victims’ payment cards or accounts while device access persists. Ajina-associated activity demonstrates increasing operational maturity. Observed tradecraft includes the use of droppers instead of directly distributed stealers, code obfuscation, anti-analysis and anti-sandbox techniques, and frequent rotation of package names and supporting infrastructure to hinder detection and blacklisting. The actor also abuses compromised Telegram accounts for propagation by sending malicious apps to people in a victim’s contact list, combining credential theft, financial fraud, and self-spreading social engineering in a mobile-first attack chain.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
5 malware families attributed to this actor across reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ajina is a threat actor group targeting Uzbekistan with Android banking trojans for financial theft.
Named threat group associated with Uzbekistan-targeted Android financial theft/SMS-stealer operations spread via Telegram, including use of banking/money-stealing malware.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.