TF-MAL-apk.gnatspy
📛 Threat Title
Malware family: GnatSpy
Description
ThreatFox malware family `apk.gnatspy`. Printable name: GnatSpy.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
apk.gnatspy
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.gnatspy
IOC database
- Type
- domain
- Value
apk.gnatspy- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-apk.gnatspy
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.gnatspy
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:apt.etda.or.th
Tool: GnatSpy ... Last change to this tool card: 28 December 2021 Download this tool card in JSON format
-
web:cybernews.com
The FBI warns of a surge in ATM jackpotting attacks, with more than 700 incidents in 2025 alone. Hackers use Ploutus malware to force machines to dispense cash.
-
web:malpedia.caad.fkie.fraunhofer.de
AridViper is a state-sponsored APT primarily targeting military personnel, journalists, and dissidents in the Middle East, with a focus on Israel and Palestine. The group employs custom-developed mobile malware , including variants like AridSpy, GnatSpy , and Micropsia, often delivered through spear-phishing emails and deceptive applications. Their operations involve sophisticated social ...
-
web:openhunting.io
The structure of the new GnatSpy variants is very different from previous variants. More receivers and services have been added, making this malware more capable and modular. We believe this indicates that GnatSpy was designed by someone with more knowledge in good software design practices compared to previous authors.
-
web:redskyalliance.org
gnatspy (1) Arid Viper The Arid Viper group has a long history of using mobile malware , including at least four Android spyware families and one short-lived iOS implant, Phenakite. The SpyC23 Android malware family has existed since at least 2019, though shared code between the Arid Viper spyware families dates back to 2017.
-
web:sechub.in
Recently, Trend Micro researchers came across a new mobile malware family which we have called GnatSpy . We believe that this is a new variant of VAMP, indicating that the threat actors behind APT-C-23 are still active and continuously improving their product.
-
web:www.cirt.gov.bd
Recently, Trend Micro researchers came across a new mobile malware family which we have called GnatSpy . We believe that this is a new variant of VAMP, indicating that the threat actors behind APT-C-23 are still active and continuously improving their product.
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.ncsc.gov.uk
How to defend organisations against malware or ransomware attacks.
-
web:www.trendmicro.com
We came across a new mobile malware family which we have called GnatSpy . We believe that this is a new variant of VAMP, indicating that the threat actors behind APT-C-23 are still active.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.