Brunhilda

aliases

Last seen:Mar 17, 2026

Intelligence Profile

PRODAFT describes Brunhilda as a "Dropper as a Service" for Google Play, delivering e.g. Alien.

Threat Analysis

Brunhilda is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.fox-it.com/2024/03/28/android-malware-vultur-expands-its-wingspan

→https://www.cleafy.com/cleafy-labs/the-android-malwares-journey-from-google-play-to-banking-fraud

→https://www.prodaft.com/m/reports/BrunHilda_DaaS.pdf

→https://www.threatfabric.com/blogs/the-attack-of-the-droppers.html

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

apk.brunhildaBrunhilda

External Intelligence

Malpedia: apk.brunhilda

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Brunhilda