{
  "name": "A Network of Harm: Gigabud Threat and Its Associates",
  "slug": "a-network-of-harm-gigabud-threat-and-its-associates",
  "description": "An investigation reveals a significant connection between Gigabud and Spynote malware families, targeting over 50 financial apps including banks and cryptocurrency platforms. The campaign utilizes sophisticated distribution methods, including 11 command and control servers and 79 phishing websites impersonating reputable brands. The malware, often protected by the Virbox packer, spreads through deceptive tactics and grants attackers remote control over compromised devices. The operation's global reach is evident, targeting not only Vietnamese entities but also international brands. This coordinated effort showcases a shift in focus from government impersonations to directly targeting financial institutions, posing risks to both consumer and corporate applications.",
  "published": "2024-09-17T09:28:52+00:00",
  "created_at": "2024-09-17T09:28:52+00:00",
  "modified_at": "2024-09-17T09:58:52+00:00",
  "created_at_opencti": "2024-09-17T09:28:52+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-09-17",
    "android rat",
    "banking trojan",
    "cryptocurrency",
    "gigabud",
    "phishing",
    "spynote"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "www.drgo.cc"
      },
      {
        "id": "",
        "name": "https://rpc.vnce6.xyz"
      },
      {
        "id": "",
        "name": "https://rpc.vnlwe.top"
      },
      {
        "id": "",
        "name": "https://h5.vngame.cyou"
      },
      {
        "id": "",
        "name": "https://h5.renavnsc.com"
      },
      {
        "id": "",
        "name": "https://h5.kindsend.cyou/"
      },
      {
        "id": "",
        "name": "http://sock.vnsame.vip:8081"
      },
      {
        "id": "",
        "name": "vneid.bzgo.cc"
      },
      {
        "id": "",
        "name": "viet.xgovn.cc"
      },
      {
        "id": "",
        "name": "viet.wgovn.cc"
      },
      {
        "id": "",
        "name": "ethiopian.zkgo.cc"
      },
      {
        "id": "",
        "name": "viet.vgovn.cc"
      },
      {
        "id": "",
        "name": "ethiopian.oxgo.cc"
      },
      {
        "id": "",
        "name": "ethiopian.orzgo.cc"
      },
      {
        "id": "",
        "name": "ethiopian.ksgo.cc"
      },
      {
        "id": "",
        "name": "ethiopian.kpgo.cc"
      },
      {
        "id": "",
        "name": "ethiopian.kopgo.cc"
      },
      {
        "id": "",
        "name": "ethiopian.kpggo.cc"
      },
      {
        "id": "",
        "name": "ethiopian.kotgo.cc"
      },
      {
        "id": "",
        "name": "ethiopian.kofgo.cc"
      },
      {
        "id": "",
        "name": "ethiopian.koego.cc"
      },
      {
        "id": "",
        "name": "ethiopian.koggo.cc"
      },
      {
        "id": "",
        "name": "ethiopian.kodgo.cc"
      },
      {
        "id": "",
        "name": "ethiopian.kago.cc"
      },
      {
        "id": "",
        "name": "ethiopian.kggo.cc"
      },
      {
        "id": "",
        "name": "dstv.xsgo.cc"
      },
      {
        "id": "",
        "name": "dstv.atferu.com"
      },
      {
        "id": "",
        "name": "dstv.atgo.cc"
      },
      {
        "id": "",
        "name": "dstv.amgo.cc"
      },
      {
        "id": "",
        "name": "dichvucong.zlgov.com"
      },
      {
        "id": "",
        "name": "dichvucong.vnvngov.com"
      },
      {
        "id": "",
        "name": "dichvucong.xgovn.net"
      },
      {
        "id": "",
        "name": "dichvucong.vgovn.net"
      },
      {
        "id": "",
        "name": "dichvucong.tkgov.com"
      },
      {
        "id": "",
        "name": "dichvucong.thongtindancu.com"
      },
      {
        "id": "",
        "name": "dichvucong.tgovn.cc"
      },
      {
        "id": "",
        "name": "dichvucong.rvgov.com"
      },
      {
        "id": "",
        "name": "dichvucong.rgovn.com"
      },
      {
        "id": "",
        "name": "dichvucong.oggov.com"
      },
      {
        "id": "",
        "name": "dichvucong.ogovn.com"
      },
      {
        "id": "",
        "name": "dichvucong.lgov.net"
      },
      {
        "id": "",
        "name": "dichvucong.kgov.net"
      },
      {
        "id": "",
        "name": "dichvucong.kxgov.com"
      },
      {
        "id": "",
        "name": "dichvucong.kgovn.cc"
      },
      {
        "id": "",
        "name": "dichvucong.dulieuquocgia.com"
      },
      {
        "id": "",
        "name": "dichvucong.hgov.cc"
      },
      {
        "id": "",
        "name": "dichvucong.govn.cc"
      },
      {
        "id": "",
        "name": "dichvucong.dlqg.org"
      },
      {
        "id": "",
        "name": "dichvucong.dancuso.com"
      },
      {
        "id": "",
        "name": "dichvucong.dancutru.com"
      },
      {
        "id": "",
        "name": "dichvucong.dancuquocgia.net"
      },
      {
        "id": "",
        "name": "dichvucong.dancucutru.com"
      },
      {
        "id": "",
        "name": "dichvucong.cvgov.com"
      },
      {
        "id": "",
        "name": "dichvucong.capnhatthongtin.com"
      },
      {
        "id": "",
        "name": "dichvucong.bvgov.com"
      },
      {
        "id": "",
        "name": "dichvucong.bgvgov.com"
      },
      {
        "id": "",
        "name": "dichvucong.bcavngov.com"
      },
      {
        "id": "",
        "name": "dichvucong.agovn.net"
      },
      {
        "id": "",
        "name": "dichvucong.agovn.com"
      },
      {
        "id": "",
        "name": "chinhphu.thongtincutru.org"
      },
      {
        "id": "",
        "name": "zoomonline.cc"
      },
      {
        "id": "",
        "name": "airways.ajgo.cc"
      },
      {
        "id": "",
        "name": "vnthanh.com"
      },
      {
        "id": "",
        "name": "vnoffice.vip"
      },
      {
        "id": "",
        "name": "vnchinhphu.org"
      },
      {
        "id": "",
        "name": "vnchinhphu.net"
      },
      {
        "id": "",
        "name": "vnchinhphu.com"
      },
      {
        "id": "",
        "name": "vn-eid.com"
      },
      {
        "id": "",
        "name": "vietvn.org"
      },
      {
        "id": "",
        "name": "vietnam-chinhphu.com"
      },
      {
        "id": "",
        "name": "vietin.cc"
      },
      {
        "id": "",
        "name": "vieteid.com"
      },
      {
        "id": "",
        "name": "vietcp.com"
      },
      {
        "id": "",
        "name": "viet-vn.com"
      },
      {
        "id": "",
        "name": "viet-in.com"
      },
      {
        "id": "",
        "name": "viet-eid.com"
      },
      {
        "id": "",
        "name": "evietnam.vip"
      },
      {
        "id": "",
        "name": "shopeeht.com"
      },
      {
        "id": "",
        "name": "eviet.vip"
      },
      {
        "id": "",
        "name": "dichvucong-gov.net"
      },
      {
        "id": "",
        "name": "dichvucong-govn.com"
      },
      {
        "id": "",
        "name": "dichvucong-gov.com"
      },
      {
        "id": "",
        "name": "chinhphu.net"
      },
      {
        "id": "",
        "name": "chinh-phu.com"
      },
      {
        "id": "",
        "name": "chinh-phu.cc"
      },
      {
        "id": "",
        "name": "sock.vnsame.vip"
      },
      {
        "id": "",
        "name": "rpc.vnwx4.xyz"
      },
      {
        "id": "",
        "name": "rpc.vnlwe.top"
      },
      {
        "id": "",
        "name": "rpc.vnce6.xyz"
      },
      {
        "id": "",
        "name": "rpc.vnjdy.top"
      },
      {
        "id": "",
        "name": "rpc.vnloy.xyz"
      },
      {
        "id": "",
        "name": "rpc.lxhaz.top"
      },
      {
        "id": "",
        "name": "h5.renavnsc.com"
      },
      {
        "id": "",
        "name": "h5.vngame.cyou"
      },
      {
        "id": "",
        "name": "h5.kindsend.cyou"
      },
      {
        "id": "",
        "name": "ops.namabank.com.vn"
      },
      {
        "id": "",
        "name": "mobile.acb.com.vn"
      },
      {
        "id": "",
        "name": "f70049c87b787829642157cf69ed94e30bc4420a5560d8744b327ca9f0e7fdf5"
      },
      {
        "id": "",
        "name": "eb1472d2d5828434ec488b05332f832ec0890bbdca859b8a8094fcf3662c844d"
      },
      {
        "id": "",
        "name": "df7f06c21da998a549f1eca8b9161c0cc286b32d60344c4ac51c21cf13d1f5ea"
      },
      {
        "id": "",
        "name": "ad8e774a3b3e9b15c3e97de105b8c0a2e04d7503f4e6c22d99ca42b259082549"
      },
      {
        "id": "",
        "name": "cdbcabe3830bb0a71ab14cfbbae56d29b0e0cd0cf52c1f818227a334c15a137c"
      },
      {
        "id": "",
        "name": "dcec15a02c9775a31f06a2634f51d9c9ea946529dc3acad4218ed53e45157b51"
      },
      {
        "id": "",
        "name": "a503e0526495525ef0ce6777c681763cc3c60838e0e02fdfbac1f6c4ef5ab166"
      },
      {
        "id": "",
        "name": "8ecd4ca7c5fc41a95ec56d5eb8df471457c07f78cb34a2888adbaf13da19e4ae"
      },
      {
        "id": "",
        "name": "8b8bba07e8c9aafe2831690bb932289af0f15dbf26205c44044def688264562c"
      },
      {
        "id": "",
        "name": "673a8e5a33a8afdc38847b69b9c422e3ae56f8a4f65f2ae6a1e512e11f085da5"
      },
      {
        "id": "",
        "name": "5240dcc7fb5c2cfc6910ef7e95192da7847bb139f666ece6847f7b9b58040429"
      },
      {
        "id": "",
        "name": "5f35569758bb6a129bea6eacdc0fa96a6ba60d7f7a2a3ae04fec1928f00523d5"
      },
      {
        "id": "",
        "name": "35c734a5c78f08ba4ef718b80b0bd005add961588b5b28ed5d34d1a6e8c93f2c"
      },
      {
        "id": "",
        "name": "337d20ec569f0c71272d83aefa8fd63221abe474ff21e9ab7558a2001dc906fb"
      },
      {
        "id": "",
        "name": "2800e5f7fe3a6c479d59f2672afbd6c4724b2d8b91d5780eb6d1ebb082dca5e0"
      },
      {
        "id": "",
        "name": "2167f5b7591900c2a99252cc1ade901082dbcf6cf15d3f08b10df2fa7ebb7d7e"
      },
      {
        "id": "",
        "name": "14a45f6d4b58082bbb4ffc20a5052ff2b83a342925c988ab612449e577e96eb6"
      },
      {
        "id": "",
        "name": "07aa10f0962a21feb350183a92868e9dce3cf2025e4e13af9dff53659c187fa4"
      },
      {
        "id": "",
        "name": "ktbcs.netbank"
      }
    ],
    "malware": [
      {
        "id": "6a3ce444-584a-4a31-a751-dbbb59074db0",
        "name": "Spynote",
        "slug": "spynote"
      },
      {
        "id": "3433a562-edc8-41b4-9447-de2e1637f8db",
        "name": "Gigabud",
        "slug": "gigabud"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Finance"
      },
      {
        "id": "",
        "name": "Government"
      }
    ]
  },
  "external_refs": [
    "https://www.zimperium.com/blog/a-network-of-harm-gigabud-threat-and-its-associates",
    "https://otx.alienvault.com/pulse/66e967f43b0ede232fa640cf"
  ]
}