Family
Sysorbit
The first one not hunting a server but a phone. Comes in over ADB, poses as a Google service, and hid its command center under three layers of encryption.
Sysorbit is unlike everything before it: it doesn’t hunt cameras or Linux servers, it hunts Android phones and devices with debugging (ADB) left open to the world. Once inside, it installs an app that poses as a Google Play service, hides itself from the app list, and —if the device is rooted— copies itself into /system disguised as a system binary.
Its real engine isn’t in the visible Java layer but in a packed native library: a denial-of-service bot that also spreads on its own, without waiting for orders. And it’s the best yet at hiding where it calls home: three layers of encryption, the last one with a key that isn’t written in the file at all — it’s manufactured at startup by joining two chunks of data that separately mean nothing.
Here we catch it coming in through the debug cable and open it layer by layer: APK, DEX and native code. The first time it beat me; I came back the next day and it opened up completely.
- 07
The one that came in through the debug cable
The previous three went after servers. This one went after a phone: it came in through ADB, wiped out the competition, installed its app disguised as Google, and hid itself. First Android malware in the honeypot.
Sysorbit
2026-08 - 08
Sysorbit laid bare: three layers to hide one address
We peel the APK apart layer by layer: a DEX that's nothing but a launcher, an app that nails itself into /system if there's root, and a native DDoS engine. The C2 slammed the door in my face — until I came back another way and it opened.
Sysorbit
2026-08