SpyFRPTunnel
Aliases: fvncBot
- First seen
- 2022-07-15 00:00:00
- Malware type
- spyware, rat
- Family
- Malware family
- Profile updated
- 2026-07-07 14:10:03
Targeted industries: government-and-public-sector technology-and-telecommunications
Context
A sophisticated mobile surveillance implant operating as a Remote Control System (RCS). This malware family is characterized by a unique, multi-sided communication architecture that abandons traditional HTTP polling. Instead, it hybridizes Firebase Cloud Messaging (FCM) for asynchronous command signaling with Fast Reverse Proxy (FRP) to establish persistent, NAT-bypassing network tunnels, effectively turning the infected mobile device into a server accessible by the attacker.
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Apk.Spyfrptunnel (report)
- medium.com — Operational Analysis Of Communication Channels In Mobile Rcs 437F9Aad5653 (report)