[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6YG2llMT8A9jfxpK6gQue0x1cL3d063VtxtKAJSXLmE":3},{"article":4,"iocs":33,"watch_terms":34,"solutions":35,"lesson":66},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"cefed2a8-1e36-4cd6-a726-d1f2ba4acc4a","Inside the Underground Business of the Android BTMOB RAT malware","inside-the-underground-business-of-the-android-btmob-rat-malware-484b7d","Flare researchers analyzed thousands of underground posts to examine how the BTMOB Android malware operation evolved into a fragmented ecosystem of resellers, source-code vendors, custom versions, and competing sales channels. [...]","The BTMOB Android RAT malware, initially a centrally operated service, has evolved into a fragmented ecosystem. This includes resellers, source-code vendors, custom versions, and competing sales channels, making it difficult for the original operator to maintain control. Flare researchers observed this shift through analysis of underground forum posts, noting how third parties offer cheaper access and source files, often with unverified authenticity.","Android BTMOB RAT malware operation fragments into a complex ecosystem of resellers and vendors.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Finside-the-underground-business-of-btmob-rat\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fposts\u002F2026\u002F07\u002F31\u002Fmobile-phone-header.jpg","2026-08-03T14:45:55+00:00","2026-08-03T16:00:29.845198+00:00",7,[17],{"name":18,"type":19},"Android","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":20,"icon":22,"name":23,"slug":24},null,"Malware","malware",[26,28],{"category":27},{"id":20,"icon":22,"name":23,"slug":24},{"category":29},{"id":30,"icon":22,"name":31,"slug":32},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[],{"controls":36,"vendors":65},[37],{"slug":32,"name":38,"problem":39,"products":40},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[41,49,57],{"vendor_slug":42,"vendor_name":43,"vendor_logo":44,"product_slug":45,"product_name":46,"url":47,"description":48},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":50,"vendor_name":51,"vendor_logo":52,"product_slug":53,"product_name":54,"url":55,"description":56},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",[],{"slug":67,"title":68,"body":69,"framework_refs":70,"framework_notes":82},"android-btmob-rat-evolves-into-fragmented-underground-ecosystem","Android BTMOB RAT Evolves Into Fragmented Underground Ecosystem","The BTMOB Android RAT malware has transitioned from a centrally controlled tool into a sprawling underground marketplace involving resellers, source-code vendors, and custom builds, significantly lowering the barrier to entry for threat actors. This fragmentation means organizations can no longer track a single threat actor or campaign — instead, they face a diverse range of operators with varying capabilities and motivations. The availability of source code makes attribution harder and enables customized variants that may evade signature-based detection. This matters because mobile devices are increasingly used to access sensitive corporate data, and RAT malware can silently exfiltrate credentials, communications, and files. Security teams must treat mobile threats with the same rigor applied to traditional endpoint threats.",[71,72,73,74,75,76,77,78,79,80,81],"CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","NIST SP 800-124: Guidelines for Managing Mobile Device Security","NIST SP 800-150: Guide to Cyber Threat Information Sharing","NIST PR.AT-1: Security Awareness and Training","NIST DE.CM-7: Monitoring for Unauthorized Personnel, Connections, Devices, and Software","MITRE ATT&CK Mobile: T1437 - Application Layer Protocol","MITRE ATT&CK Mobile: T1430 - Location Tracking","GDPR Article 32: Security of Processing (for organizations handling EU data on mobile devices)",{}]