S1067: FluBot

FluBot is a multi-purpose mobile banking malware that was first observed in Spain in late 2020. It primarily spread through European countries using a variety of SMS phishing messages in multiple languages.[1][2] An international law enforcement operation of 11 countries eventually disrupted the spread of FluBot.[3]

MobileS1067MalwareObject v1.1ModifiedMar 27, 2025, 22:35 UTC (UTC+00:00)

S1067: FluBot describes [FluBot](https://attack.mitre.org/software/S1067) is a multi-purpose mobile banking malware that was first observed in Spain in late 2020. It primarily spread through European countries using a variety of SMS phishing messages in multiple languages.(Citation: proofpoint_flubot_0421)(Citation: bitdefender_flubot_0524) An international law enforcement operation of 11 countries eventually disrupted the spread of [FluBot](https://attack.mitre.org/software/S1067).(Citation: Europol FluBot Jun2022)

Executive priority

S1067: FluBot is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S1067: FluBot by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Android), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata

Detection direction

Validate whether S1067: FluBot appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

FluBot

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques17 rows

Domain	ID	Name	Relationship / procedure
Mobile	T1582	SMS Control	FluBot can send SMS phishing messages to other contacts on an infected device.[1][2]
Mobile	T1637.001	Domain Generation AlgorithmsSub-technique	FluBot can use Domain Generation Algorithms to connect to the C2 server.[1]
Mobile	T1636.003	Contact ListSub-technique	FluBot has used the contact list to infect more devices.[1][3]
Mobile	T1629.003	Disable or Modify ToolsSub-technique	FluBot can disable Google Play Protect to prevent detection.[1][3]
Mobile	T1409	Stored Application Data	FluBot has collected credentials, banking details and other information from the victim device.[3]
Mobile	T1406	Obfuscated Files or Information	FluBot can obfuscated class, string, and method names in newer malware versions.[1]
Mobile	T1417.002	GUI Input CaptureSub-technique	FluBot can add display overlays onto banking apps to capture credit card information.[1]
Mobile	T1660	Phishing	FluBot has been distributed via malicious links in SMS messages.[3]
Mobile	T1604	Proxy Through Victim	FluBot can use a SOCKS proxy to evade C2 IP detection.[1]
Mobile	T1437.001	Web ProtocolsSub-technique	FluBot can use HTTP POST requests on port 80 for communicating with its C2 server.[1]
Mobile	T1628.002	User EvasionSub-technique	FluBot can use `locale.getLanguage()` to choose the language for notifications and avoid user detection.[1]
Mobile	T1453	Abuse Accessibility Features	FluBot abuses accessibility features in three ways: steal application credentials, evade detection and removal, and send SMS for lateral movement.CitationSahinSRLabs_FluBot_Dec2021
Mobile	T1636.004	SMS MessagesSub-technique	FluBot can intercept SMS messages and USSD messages from Telcom operators.[1]
Mobile	T1646	Exfiltration Over C2 Channel	FluBot can send contact lists to its C2 server.[1]
Mobile	T1521.002	Asymmetric CryptographySub-technique	FluBot has encrypted C2 message bodies with RSA and encoded them in base64.[1]
Mobile	T1517	Access Notifications	FluBot can access app notifications.[1]
Mobile	T1629.001	Prevent Application RemovalSub-technique	FluBot can use Accessibility Services to make removal of the malicious app difficult.[2]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.2
Object version: 1.1
Created: Feb 28, 2023, 20:25 UTC (UTC+00:00)
Modified: Mar 27, 2025, 22:35 UTC (UTC+00:00)
Raw hash: 4578df2da703573a...

Imported snapshots across ATT&CK releases(2)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	1.1	Mar 27, 2025, 22:35 UTC (UTC+00:00)	Current bundle	`4578df2da703…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.1	Mar 27, 2025, 22:35 UTC (UTC+00:00)	Older bundle	`4578df2da703…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
proofpoint_flubot_0421
Crista Giering, F. Naves, Andrew Conway, Adam McNeil . (2021, April 27). FluBot Android Malware Spreading Rapidly Through Europe, May Hit U.S. Soon. Retrieved February 28, 2023.
Open source URL
[2]
bitdefender_flubot_0524
Filip TRUȚĂ, Răzvan GOSA, Adrian Mihai GOZOB. (2022, May 24). New FluBot Campaign Sweeps through Europe Targeting Android and iOS Users Alike. Retrieved February 28, 2023.
Open source URL
[3]
Europol FluBot Jun2022
Europol. (2022, June 1). Takedown of SMS-based FluBot spyware infecting Android phones. Retrieved April 18, 2024.
Open source URL
[4]
mitre-attackS1067
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use