AnDROid
- Malware type
- ransomware
- Family
- Malware family
- Last IoC activity
- 2026-07-22 04:04:45
- Profile updated
- 2026-07-07 16:17:05
Targeted industries: financial-services healthcare-and-pharmaceutical technology-and-telecommunications
Context
AnDROid is a ransomware variant targeting Android devices. It encrypts files and demands a ransom for their decryption, often affecting industries such as financial services and healthcare.
Detection coverage
- 7 YARA rules
Used by threat actors
- C0033 (campaign)
- Operation Bearded Barbie (campaign)
- Operation Dust Storm (campaign)
Detection rules
- VOLEXITY_Apt_Malware_Apk_Badbazaar_Stage2_Implant_May23 (yara-rule)
- WITHSECURELABS_Fallspy (yara-rule)
- HARFANGLAB_Samecoin_Campaign_Nativewiper (yara-rule)
- SEKOIA_Trojan_Android_Brata (yara-rule)
- SEKOIA_Trojan_Android_Cerberus (yara-rule)
- SEKOIA_Apt_Spynote_Android_Dex_Strings (yara-rule)
- SEKOIA_Trojan_Android_Xenomorph (yara-rule)