APT / THREAT GROUP

Crocodilus

aliases

Last seen:Mar 17, 2026

Intelligence Profile

According to ThreatFabric, this malware offers remote control, black screen overlays, and advanced data harvesting via accessibility logging.

Threat Analysis

Crocodilus is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://medium.com/@mvaks/bombardino-crocodilo-in-poland-analysis-of-iko-lokaty-mobile-malware-campaign-502bd74947f3

→https://medium.com/@mvaks/crocodilus-in-the-wild-mapping-the-campaign-in-poland-15d3078eb954

→https://shindan.io/blog/crocodilus-a-deep-dive-into-its-structure-and-capabilities

→https://www.threatfabric.com/blogs/crocodilus-mobile-malware-evolving-fast-going-global

→https://www.threatfabric.com/blogs/exposing-crocodilus-new-device-takeover-malware-targeting-android-devices

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

Crocodilusapk.crocodilus

External Intelligence

Malpedia: apk.crocodilus

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Crocodilus