This IP address has been tied to Transparent Tribe’s CrimsonRAT and AhMyth Android RAT C2 activity since at least 2022.
Malware family
AhMyth
AhMyth is an Android remote access trojan (RAT) and open-source malware available on GitHub.
Profile source: Mallory opens in a new tabAhMyth
Family profile
AhMyth is an Android remote access trojan (RAT) and open-source malware available on GitHub. The provided content describes it as being distributed through infected Android applications on various app stores and as capable of keylogging, taking screenshots, and intercepting SMS-based one-time passwords (OTPs) used for MFA bypass. AhMyth is also referenced as a tool leveraged in campaigns by multiple threat actors, including Transparent Tribe and Iranian APT activity more broadly. One report states that the IP address 173.249.50.243 had been tied to Transparent Tribe’s CrimsonRAT and AhMyth Android RAT command-and-control activity since at least 2022. The content also notes AhMyth among the top mobile malware families in April 2025 and mentions a modified version of AhMyth being used in the wild.
Reported operators
Threat actors
1 named in public reportingReporting
Research mentioning AhMyth
Jul 21
Securityaffairs
MuddyWater deploys new DCHSpy variants amid Iran-Israel conflict
"These groups also leverage tools like Metasploit, AndroRat, and AhMyth in campaigns."
May 12
Hackread
FakeUpdates, Remcos, AgentTesla Top Malware Charts in Stealth Attack Surge
"...with Anubis, AhMyth, and Hydra topping the list of mobile malware in April."
Apr 11
Sentinelone Labs
CapraTube Remix | Transparent Tribe’s Android Spyware Targeting Gamers, Weapons Enthusiasts | SentinelOne
This IP address has been tied to Transparent Tribe’s CrimsonRAT and AhMyth Android RAT C2 activity since at least 2022.
Jul 25
Infosecurity Magazine
Malware Attacks Surge 30% in First Half of 2024
AhMyth. This RAT, which targets Android devices through infected apps on various stores, performing keylogging, taking screenshots and intercepting MFA OTPs
Apr 30
Securelist
APT trends report Q1 2020
“a modified version of the AhMyth Android RAT which is open source malware available on GitHub.”
