BTMob Mobile RAT Source Code Leak Expands Access Across Cybercriminal Underground
Flashpoint analysts detail how BTMob, a mobile remote access trojan (RAT) first released in late 2024 and derived from the SpySolr family (itself linked to CraxsRAT and CypherRAT in the lineage of the Syria-based developer EVLF), has gained broader traction across underground communities after its source code leaked on forums including Breach Forums in February 2026. BTMob gives operators extensive mobile surveillance capabilities, including screen monitoring, SMS/call interception, camera/microphone/GPS access, keylogging, and silent application installation. The leak weakened the original developers' control over the malware, enabling unrelated actors to reverse engineer, modify, and resell leaked versions, which fragmented the market and complicated attribution since different actors with varying objectives now deploy the same codebase. Disputes have emerged over counterfeit or potentially malicious copies, with some resellers accused of embedding malicious code in their repackaged BTMob builds to compromise other criminals.
Detalhes técnicos
BTMob incorporates components written in VB.NET, Java, Node.js, PHP, MySQL, HTML, CSS, and JavaScript, and its control panel displays the phrase "BTMOB BY EVLF," reflecting its lineage. Version 4.0 was released on January 25, 2025, reportedly developed by an actor using the handles S1mp1y Ducky, ME8TE3N, and H7TEEN Anon, with DaarkShop (also known as GhostKernel) serving as the malware's primary seller via Crax Shop. Flashpoint has not confirmed the full extent of each actor's development role. H7TEEN Anon has promoted BTMob via Telegram, including a March 15, 2026 demonstration video, and separately claimed to sell stealers and ransomware, and shared a link purportedly offering access to the malicious LLM WormGPT on February 17, though Flashpoint could not confirm the tool was used to develop BTMob.
Following the leak, two groups emerged: reverse engineers and unauthorized resellers. The actor V0id.Ade1r (also known as PriceAde1r/Sparticus) markets modified BTMob builds alongside Celestial Rat and Sential Stealer, positioning itself as a "reverse engineer, not a reseller," and has accused a Brazilian seller known as Boiano of distributing fake BTMob copies while impersonating EVLF. Other actors, such as a Telegram user operating as "Owl," falsely claimed to have developed BTMob version 4.0 while only offering its leaked source code, and an actor named "R H" advertised a free seven-day BTMob trial pointing to a potentially malicious download.
Remediação
Organizations should treat BTMob as part of the broader CraxsRAT/CypherRAT/SpySolr lineage of commodity Android RATs distributed as malware-as-a-service, and apply standard mobile threat defenses: restrict sideloading and installation from untrusted sources, monitor for abuse of Android Accessibility Services, and apply mobile threat detection capable of identifying RAT-style surveillance behavior (screen capture, SMS/call interception, keylogging). Given the malware's capacity to intercept communications and credentials, organizations should pay particular attention to devices used for financial transactions or access to sensitive accounts.
Linha do tempo
-
BTMob Mobile RAT Source Code Leak Expands Access Across Cybercriminal Underground
ler a análise desta fonte ocultar
Flashpoint analysts detail how BTMob, a mobile remote access trojan (RAT) first released in late 2024 and derived from the SpySolr family (itself linked to CraxsRAT and CypherRAT in the lineage of the Syria-based developer EVLF), has gained broader traction across underground communities after its source code leaked on forums including Breach Forums in February 2026. BTMob gives operators extensive mobile surveillance capabilities, including screen monitoring, SMS/call interception, camera/microphone/GPS access, keylogging, and silent application installation. The leak weakened the original developers' control over the malware, enabling unrelated actors to reverse engineer, modify, and resell leaked versions, which fragmented the market and complicated attribution since different actors with varying objectives now deploy the same codebase. Disputes have emerged over counterfeit or potentially malicious copies, with some resellers accused of embedding malicious code in their repackaged BTMob builds to compromise other criminals.
Technical Details
BTMob incorporates components written in VB.NET, Java, Node.js, PHP, MySQL, HTML, CSS, and JavaScript, and its control panel displays the phrase "BTMOB BY EVLF," reflecting its lineage. Version 4.0 was released on January 25, 2025, reportedly developed by an actor using the handles S1mp1y Ducky, ME8TE3N, and H7TEEN Anon, with DaarkShop (also known as GhostKernel) serving as the malware's primary seller via Crax Shop. Flashpoint has not confirmed the full extent of each actor's development role. H7TEEN Anon has promoted BTMob via Telegram, including a March 15, 2026 demonstration video, and separately claimed to sell stealers and ransomware, and shared a link purportedly offering access to the malicious LLM WormGPT on February 17, though Flashpoint could not confirm the tool was used to develop BTMob.
Following the leak, two groups emerged: reverse engineers and unauthorized resellers. The actor V0id.Ade1r (also known as PriceAde1r/Sparticus) markets modified BTMob builds alongside Celestial Rat and Sential Stealer, positioning itself as a "reverse engineer, not a reseller," and has accused a Brazilian seller known as Boiano of distributing fake BTMob copies while impersonating EVLF. Other actors, such as a Telegram user operating as "Owl," falsely claimed to have developed BTMob version 4.0 while only offering its leaked source code, and an actor named "R H" advertised a free seven-day BTMob trial pointing to a potentially malicious download.
Remediation
Organizations should treat BTMob as part of the broader CraxsRAT/CypherRAT/SpySolr lineage of commodity Android RATs distributed as malware-as-a-service, and apply standard mobile threat defenses: restrict sideloading and installation from untrusted sources, monitor for abuse of Android Accessibility Services, and apply mobile threat detection capable of identifying RAT-style surveillance behavior (screen capture, SMS/call interception, keylogging). Given the malware's capacity to intercept communications and credentials, organizations should pay particular attention to devices used for financial transactions or access to sensitive accounts.