Skygofree Skygofree

  • First known sample

    2014

  • Discovery

    2017

  • Number of targets

    1-100

  • Current status

    Active

  • Type

    Cyberespionage toolkit

  • Targeted platforms

    Android , Windows

  • TOP targeted countries

    Italy
SKYGOFREE

More about the Skygofree malware, its targets and capabilities

Learn more

  • The way of propagation

    Exploits

  • Purpose/Functions

    Cyberespionage
  • Special features

    Skygofree includes functionality never seen in the wild before, such as location-based audio recording through infected devices. The spyware is spread through web pages mimicking leading mobile network operators.

  • Artefacts/Attribution

    Given the many artifacts we discovered in the malware code, as well as infrastructure analysis, we are pretty confident that the developer of the Skygofree implants is an Italian IT company that works on surveillance solutions, just like HackingTeam. Please find more information here. Please find IOC here.

  • Description

    A type of Android spyware first discovered in 2017 primarily targeting victims in Italy. Spread through fake landing pages that mimic those of mobile operators, this malware possesses the ability to record audio surroundings, steal WhatsApp messages via Accessibility Services, and connect an infected device to Wi-Fi networks controlled by cybercriminals.

    Additional information

© 2025 AO Kaspersky Lab. All Rights Reserved. Privacy Policy Cookies
  1. Adding detection for known modules
  2. Collecting samples
  3. Reversing the samples
  4. Decrypting sophisticated encryption and compression schemes
  5. Understanding lateral movement
  6. Outlining multiple attack stages in the correct order
  7. Mapping C&C infrastructure
  8. Setting up sinkholes
  9. Analyzing collected traffic and communication protocols
  10. Crawling other hosts that understand the same protocol
  11. Taking down and acquiring images of C&C servers
  12. Identifying victims, sending out notifications to victims and global CERTs
  13. Applying forensic analysis and extracting logs, stolen files, other components
  14. Collecting and analyzing data from KSN, C&C servers, individual victims who are willing to work with us, sinkholes, crawlers, etc.
  15. Writing a comprehensive report
Read more
Mitigation is where enterprises need to start, prevention being significantly more effective and more cost-efficient than remediation after an attack Read more
For any inquiries, please contact apt.securelist@kaspersky.com If you are looking for more detailed information about an APT, please contact intelreports@kaspersky.com