HOMETHREATSHyperBro
APT / THREAT GROUP

HyperBro

2
aliases
Last seen:Mar 17, 2026

Intelligence Profile

HyperBro is a RAT that has been observed to target primarily within the gambling industries, though it has been spotted in other places as well. The malware typically consists of 3 or more components: a) a genuine loader typically with a signed certification b) a malicious DLL loader loaded from the former component via DLL hijacking c) an encrypted and compressed blob that decrypts to a PE-based payload which has its C2 information hardcoded within.

Threat Analysis

HyperBro is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→http://www.talent-jump.com/article/2020/02/17/CLAMBLING-A-New-Backdoor-Base-On-Dropbox-en/
→https://blog.sekoia.io/luckymouse-uses-a-backdoored-electron-app-to-target-macos/
→https://blog.team-cymru.com/2020/03/25/how-the-iranian-cyber-security-agency-detects-emissary-panda-malware/
→https://cyware.com/news/apt27-group-targets-german-organizations-with-hyperbro-2c43b7cf/
→https://decoded.avast.io/luigicamastra/apt-group-targeting-governmental-agencies-in-east-asia

Quick Facts

TypeAPT / Threat Group
Aliases2

Also Known As

win.hyperbroHyperBro

External Intelligence

Malpedia: win.hyperbro

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search HyperBro