A Network of Harm: Gigabud Threat and Its Associates

Executive Summary: Researchers link Gigabud (banking trojan) and Spynote (Android RAT) to a coordinated campaign that uses shared domains and distribution infrastructure; the operation used a Virbox packer, 11 C2 servers, 79 phishing websites impersonating reputable brands, and targeted over 50 financial and crypto mobile apps, enabling credential theft and potential exfiltration of sensitive corporate and consumer data.