Home > List all groups > List all tools > List all groups using tool BADSIGNAL

Threat Group Cards: A Threat Actor Encyclopedia

Names	BADSIGNAL
Category	Malware
Type	Backdoor
Description	(Volexity) In contrast to BadBazaar and BADSOLAR, BADSIGNAL does not download a second-stage payload. Instead, all capabilities are included in the main APK. The malicious code is loaded by extending the legitimate PassPhraseRequiredActivity class in org.thoughtcrime.securesms.MainActivity. BADSIGNAL uses a REST API on port 4432 as part of its C2 communication.
Information	<https://www.volexity.com/blog/2023/09/22/evilbamboo-targets-mobile-devices-in-multi-year-campaign/>

Last change to this tool card: 12 October 2023

Download this tool card in JSON format

1 group listed (1 APT, 0 other, 0 unknown)

APT groups