Loading threat actor…
EVLF is an online alias linked to the development and commercialization of Android malware used for financial fraud. The actor has been associated with BTMOB, an Android remote access trojan marketed as a malware-as-a-service offering, and has also been linked to the CraxsRAT, CypherRAT, and SpySolr malware families. Reporting ties EVLF to a Syrian threat actor persona and identifies the handle @craxso as associated with the same operator. BTMOB has been advertised with subscription, lifetime-license, and source-code sale options, indicating a commercial malware operation aimed at enabling other cybercriminals. The malware supports remote control of infected Android devices and a broad set of surveillance and theft functions, including credential theft, keylogging, screenshot capture, device unlocking, accessibility-service abuse, and capture of payment-related secrets such as PINs. Distribution has relied on social-engineering lures, fake websites, and counterfeit app-store pages that trick victims into installing malicious Android packages and granting elevated accessibility permissions. The actor’s activity is consistent with financially motivated cybercrime focused on mobile-device compromise and downstream banking or payment fraud. EVLF’s tooling lowers the barrier to entry for affiliates or customers by providing builder functionality and customizable payload generation. The known tradecraft directly supports initial access through social engineering, persistence and post-exploitation on compromised devices, credential theft, keylogging, exfiltration, and defense evasion through abuse of legitimate Android features and anti-analysis-aware malware development.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
7 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 malware families attributed to this actor across reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Advertises and sells the BTMOB Android RAT under a malware-as-a-service model, including subscriptions, lifetime licenses, and full server source code.
Syrian-linked threat actor associated (via tooling lineage) with Android RAT families (CraxsRAT/CypherRAT/SpySolr) and the BTMOB RAT evolution used for persistent remote control and surveillance of Android devices; indirectly relevant here because BeatBanker campaigns have been observed dropping BTMOB as a payload.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.