MALWARE FAMILY

HyperBro

Internal ID: win.hyperbro

aliases

Last seen:Mar 17, 2026

Intelligence Profile

HyperBro is a RAT that has been observed to target primarily within the gambling industries, though it has been spotted in other places as well. The malware typically consists of 3 or more components: a) a genuine loader typically with a signed certification b) a malicious DLL loader loaded from the former component via DLL hijacking c) an encrypted and compressed blob that decrypts to a PE-based payload which has its C2 information hardcoded within.

Threat Analysis

HyperBro is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→http://www.talent-jump.com/article/2020/02/17/CLAMBLING-A-New-Backdoor-Base-On-Dropbox-en/

→https://blog.sekoia.io/luckymouse-uses-a-backdoored-electron-app-to-target-macos/

→https://blog.team-cymru.com/2020/03/25/how-the-iranian-cyber-security-agency-detects-emissary-panda-malware/

→https://cyware.com/news/apt27-group-targets-german-organizations-with-hyperbro-2c43b7cf/

→https://decoded.avast.io/luigicamastra/apt-group-targeting-governmental-agencies-in-east-asia

→https://decoded.avast.io/luigicamastra/apt-group-targeting-governmental-agencies-in-east-asia/

→https://decoded.avast.io/luigicamastra/apt-group-targeting-governmental-agencies-in-east-asia/?utm_source=rss&utm_medium=rss&utm_campaign=apt-group-targeting-governmental-agencies-in-east-asia

→https://securelist.com/luckymouse-hits-national-data-center/86083/

→https://team-cymru.com/2020/03/25/how-the-iranian-cyber-security-agency-detects-emissary-panda-malware/

→https://vblocalhost.com/uploads/VB2020-Shank-Piccolini.pdf

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.hyperbro

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search HyperBro