Mamont

Family profile

Mamont is an Android banking Trojan family that emerged in late 2023 and became one of the most prevalent mobile banking malware families affecting users in Russia, the CIS, and other regional campaigns through 2024–2026. It is actively developed, with numerous variants and both banker and dropper-classified samples observed in the wild. Mamont has been associated with large-scale Android banking Trojan activity and has repeatedly dominated mobile banker detections in industry telemetry.

Mamont is distributed through social-engineering lures rather than exploit-driven infection. Documented delivery schemes include fake parcel-tracking applications tied to fraudulent online storefronts and Telegram-based order scams, instant-message lures, fake offers in neighborhood or community chats, and trojanized Android applications such as a fake dating app targeting Uzbek-speaking users. Some variants use a multi-stage infection chain in which an initial Android dropper decrypts and installs a second-stage payload, including encrypted embedded APKs.

Once installed, Mamont requests extensive Android permissions related to SMS, phone state, calls, notifications, and background execution. Its core behavior centers on theft and abuse of financial communications. Observed capabilities include intercepting SMS messages, harvesting one-time codes, hijacking push notifications, collecting device and SIM information, enumerating installed applications, and extracting financial data from banking alerts. Certain variants parse multilingual SMS content for transaction and balance information. Mamont also supports remote command execution through command-and-control infrastructure, enabling operators to send SMS messages, place calls, issue USSD requests, retrieve recent messages, and trigger additional data collection.

Mamont also includes defense-evasion and post-compromise tradecraft. Operators can hide or alter the app icon, keep malicious logic running in the background, and use staged installation flows to transfer execution from a visible lure app to the real payload. Some variants expose custom prompts and image-upload interfaces that allow attackers to solicit additional victim data and support follow-on social-engineering fraud. These functions expand Mamont beyond simple OTP theft into broader account takeover and financial fraud operations.

Victimology is strongest for Android users in Russia and neighboring CIS markets, but localized campaigns have also targeted Uzbek-speaking users. Small businesses and individual consumers have both been targeted, especially where mobile devices are used for banking, order management, or receipt of transaction confirmations. Available reporting supports classifying Mamont as a mature, modular Android banking Trojan family focused on SMS and notification interception, remote fraud enablement, and socially engineered delivery.

Capabilities

Credential Theft
Defense Evasion
Exfiltration
Post Exploitation

Observed infrastructure

Last seven days

First activity: Sep 3, 2026
Last activity: Sep 5, 2026
Feed role: Distribution
Host form: 0 IP / 4 hostnames

Leading locations

Leading providers

Amazon.com, Inc.2
"Domain names registrar REG.RU", Ltd1
Domain names registrar REG.RU, Ltd1

Infrastructure traits

Hosting 4
Anycast 2

MITRE ATT&CK

Mamont in ATT&CK

19 distinct techniques

Techniques

19 techniques

T1056 Input Capture T1041 Exfiltration Over C2 Channel T1566 Phishing T1005 Data from Local System T1036 Masquerading T1564 Hide Artifacts T1071 Application Layer Protocol T1649 Steal or Forge Authentication Certificates T1105 Ingress Tool Transfer T1204.002 Malicious File T1528 Steal Application Access Token T1106 Native API T1140 Deobfuscate/Decode Files or Information T1566.002 Spearphishing Link T1082 System Information Discovery T1497.001 System Checks T1518 Software Discovery T1204 User Execution T1027 Obfuscated Files or Information

Reporting

Research mentioning Mamont

Aug 10

Cyber Security News

Google Play Apps Use Stealth Loaders to Deliver Anatsa Banking Malware

Kaspersky reported that Android attacks involving malware, adware, and unwanted software fell to 1,996,823 in Q2 2026 from 2,676,328 in the previous quarter, but banking malware remained the leading threat. Trojan-Banker detections accounted for 30.77% of malicious applications, and researchers identified more than 304,000 malicious installation packages, including 93,574 mobile banking Trojan packages and 570 mobile ransomware packages. The report also noted that some banking Trojans were reclassified as droppers as attackers increasingly packed payloads, contributing to growth in Trojan-Dropper detections. The quarter’s most notable campaigns included malicious loaders distributed through Google Play. Researchers said a trojanized PDF reader was used to deliver the Anatsa banking Trojan, while the Cleanova app relied on SDK telemetry to selectively activate malicious functionality and evade app store review. Kaspersky also said Triada variants remained prominent, Mamont banking Trojan variants rose sharply and appear to be under active development, and attacks tied to some pre-installed Trojans declined, likely because vendors patched affected firmware.

Aug 10

Malware News