Threat Intelligence Report: Premium VPN Android — Confirmed Spyware with Active Data Exfiltration
TLP:CLEAR — This report may be freely shared without restriction.
About
This site publishes open-source threat intelligence research produced by Cairn Intelligence — a cybersecurity intelligence consultancy based in Paisley, Scotland.
Research is conducted by Sam Dalgleish, founder of Cairn Intelligence and a cybersecurity researcher specialising in malware analysis, OSINT attribution, and threat infrastructure investigation. Reports are published in the public interest under TLP classification and follow responsible disclosure practices.
Cairn Intelligence provides threat intelligence services to Scottish SMEs — including monthly briefings, phishing triage, and infrastructure investigation. Visit cairnintelligence.com for more.
Methodology
Each report follows a structured intelligence workflow:
- IOC identification via ThreatFox, VirusTotal, and open threat feeds
- Infrastructure analysis using Shodan, WHOIS, and passive DNS
- Malware and binary analysis via static reverse engineering and sandbox environments
- Attribution through OSINT cross-referencing across multiple independent sources
- Responsible disclosure prior to or concurrent with publication
Reports
Recent Posts
Threat Intelligence Report: Remcos RAT C2 Infrastructure Investigation
TLP:CLEAR — This report may be freely shared without restriction.
Threat Intelligence Report: GHOST RAT C2 Infrastructure Investigation
TLP:CLEAR — This report may be freely shared without restriction.