Skygofree
MITRE ATT&CK: S0327 View on attack.mitre.org
Aliases: Skygofree
- First seen
- 2014-01-01 00:00:00
- Malware type
- spyware, rat
- Family
- Malware family
- Operating systems
- android
- Related IoCs
- 3 (3 malicious)
- Last IoC activity
- 2026-08-10 05:34:38
- Profile updated
- 2026-07-07 14:09:50
Targeted industries: government-and-public-sector technology-and-telecommunications
Targeted regions: country_code:it
Context
Skygofree is Android spyware that is believed to have been developed in 2014 and used through at least 2017.
Recent IoC activity
3 malicious indicators in Maltiverse are attributed to Skygofree (S0327). The 3 most recently updated:
| Type | Indicator | Updated | Sources |
|---|---|---|---|
| file sample | Skygofree_exploits.apk | 2026-08-10 | 3 |
| file sample | Skygofree_pe.apk | 2026-08-07 | 3 |
| file sample | f241af9ba7501e28974729c229b445ee709a7ef438448b6e9f88ff7ff7228cb2 | 2026-07-07 | 2 |
Malware & tools used
- Audio Capture (attack-pattern)
- Location Tracking (attack-pattern)
- Video Capture (attack-pattern)
- Download New Code at Runtime (attack-pattern)
- Out of Band Data (attack-pattern)
- Stored Application Data (attack-pattern)
- Exploitation for Privilege Escalation (attack-pattern)
- Web Protocols (attack-pattern)
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Apk.Skygofree (report)
- Kaspersky — 83603 (report)
- MITRE ATT&CK — S0327 (report)