CLASSFON
- First seen
- 2015-06-15 00:00:00
- Malware type
- trojan, backdoor
- Profile updated
- 2026-07-07 14:52:49
Targeted industries: government-and-public-sector financial-services
Targeted regions: country_code:us
Context
CLASSFON is a sophisticated malware used as a backdoor and trojan primarily targeting government and financial institutions, allegedly for espionage purposes. It has been in use since at least mid-2015, primarily affecting the United States.
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Classfon_Auto (yara-rule)
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Win.Classfon (report)
- Mandiant — Rpt Apt41 (report)