Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 23:44:37 UTC
Home > List all groups > List all tools > List all groups using tool KsRemote
 Tool: KsRemote
Names KsRemote
Category Malware
Type Backdoor, Info stealer, Exfiltration
Description
(Malwarebytes) We also found several malicious Android applications we believe are part of
the toolset used by this APT group. Malwarebytes detects them as
Android/Trojan.Spy.AndroRat.KSRemote.
All these bogus applications contain a jar file named ksremote.jar that provides the RAT
functionality:
• Recording screen and audio using the phone’ss camera/mic
• Locating phone with coordinates
• Stealing phone contacts, call log, SMS, web history
• Sending SMS messages
Information
Malpedia Last change to this tool card: 10 August 2021
Download this tool card in JSON format
All groups using tool KsRemote
Changed Name Country Observed
APT groups
 Bronze Highland 2012-Jul 2024
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=3eb1ad56-859e-41ef-b3c7-e5474133fce0
Page 1 of 2

1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=3eb1ad56-859e-41ef-b3c7-e5474133fce0
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=3eb1ad56-859e-41ef-b3c7-e5474133fce0
Page 2 of 2