NCSC-MAR-Infamous-Chisel.pdf

Infamous Chisel is a suite of Android malware attributed to the Sandworm group that enables persistent root execution by replacing /system/bin/netd, configures a Tor hidden service to provide SSH/SCP access (using modified Dropbear), and periodically collects and exfiltrates system, application and military-specific files and network reconnaissance data; the report includes detailed component descriptions, file hashes, file paths, YARA rules and detection guidance.