Skip to main content

RedAlert.apk

This is a defensive tool-intelligence page. It is intended for analyst navigation, source review, and hunt planning. It is not a malware-analysis report and does not contain sample code or binaries.

Summary

  • Associated actor(s): APT-C-23
  • Tool type(s): Mobile spyware / trojanized app
  • Confidence level(s): Low
  • Source ID(s): SRC-CYBERNEWS-REDALERT-2026

Behavior

ActorBehavior Summary
APT-C-23Secondary Cybernews/Acronis coverage describes malicious RedAlert-themed Android application delivery against Israeli users.

Hash And IOC Status

ActorStatusReference
APT-C-23Hash not committed; provisional until primary Acronis reporting is available.SRC-CYBERNEWS-REDALERT-2026

Hashes and IOCs on this page are source pointers or representative public indicators. They SHOULD be refreshed from the linked source before operational use and MUST NOT be used alone for actor attribution.

Defensive Hunting Notes

ActorHunting Notes
APT-C-23Hunt smishing delivery, sideloaded alert apps, OTP/SMS access permissions, and spoofed app identities.

Handling Notes

ActorHandling Notes
APT-C-23Keep provisional and clearly labelled.

Mapped ATT&CK Techniques For Associated Actor(s)

ActorTechniqueTacticMapping QualitySource
APT-C-23T1660 PhishingInitial Access (Mobile)M2SRC-ESET-ARIDSPY
APT-C-23T1204.002 User Execution: Malicious FileExecutionM3SRC-ESET-ARIDSPY

These detections are mapped through the associated actor or scenario and are not automatically tool-specific. Promote a tool-specific detection only after the behavior is tied to telemetry and test evidence.

No repository detection is currently mapped to the associated actor(s). Use the hunting notes and source references as backlog input.

These hunts are mapped through the associated actor or scenario and may need narrowing before they are used for this specific tool.

No repository hunt is currently mapped to the associated actor(s). Create a hunt from the behavior and telemetry notes before proposing a production detection.

Source Review

SourcePublisherDateReliabilityTypeLast Reviewed
SRC-CYBERNEWS-REDALERT-2026Cybernews / Acronis coverage2026-03BNews / vendor coverage2026-05-14

If a source publishes a large or frequently changing IOC appendix, keep the current IOC list in the source system or TIP and store only the pointer here.