Bahamut__2020__report-spark-bahamut.pdf

BlackBerry's report analyzes BAHAMUT, a sophisticated hack‑for‑hire threat actor that operates an extensive ‘fake’ ecosystem of websites, social media personas, and mobile apps to conduct targeted phishing and credential harvesting; it documents cross‑platform malware (Android, iOS, Windows, macOS), active malicious apps in official stores, the reuse/co‑option of a long‑running InPage zero‑day, and provides technical indicators, decoding scripts, and attribution linking numerous prior research clusters to one actor.