ITG18: Operational Security Errors Continue to Plague Sizable Iranian Threat Group

X-Force researchers discovered a file named WhatsApp.apk (md5: a04c2c3388da643efef67504ef8c6907fb) on infrastructure associated with ITG18 operations. LittleLooter is a modified version of Android malware reported by third party researchers several years ago and has likely been in use for years prior to our association with this threat group. The new tool updates itself by downloading a zip file from a URL on the C2 server: http[:]//[C2server]/updates/update_[class name].zip”]

Source: https://securityintelligence.com/posts/itg18-operational-security-errors-plague-iranian-threat-group/