Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 15:24:55 UTC
Home > List all groups > List all tools > List all groups using tool S.O.V.A.
 Tool: S.O.V.A.
Names S.O.V.A.
Category Malware
Type Banking trojan, Backdoor, Info stealer, Credential stealer, Keylogger
Description
(ThreatFabric) Sova is the Russian word for owl. This name was chosen by the threat
actor himself/herself possibly because of owl’s nature as nocturnal birds of prey, quiet
but efficient in stalking and capturing their victims. This identifies a completely new, to
the best of our knowledge, Android banking trojan. The trojan is currently in
development and testing phase, and has the objective to add to his overlay and
keylogging mechanisms, other higly dangerous features like DDoS and Ransomware in
future versions. There are a few interesting aspects that differentiate this trojan to
already existing ones, both in features as well as in development.
Information
MITRE ATT&CK Malpedia Last change to this tool card: 22 June 2023
Download this tool card in JSON format
All groups using tool S.O.V.A.
Changed Name Country Observed
Unknown groups
 _[ Interesting malware not linked to an actor yet ]_
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=a545cd80-eb52-4142-b66b-110068498b4a
Page 1 of 2

1 group listed (0 APT, 0 other, 1 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=a545cd80-eb52-4142-b66b-110068498b4a
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=a545cd80-eb52-4142-b66b-110068498b4a
Page 2 of 2