GoKawiilThe Android RAT’s official operation is surrounded by cheaper resellers, alleged source-code vendors, independent server owners, and possible impersonators.
BTMOB has been covered by several cybersecurity publications, primarily through technical analyses of the malware and its capabilities, but much less has been reported about the ecosystem that has developed around it.
Activity observed by Flare researchers in underground forums and chat platforms reveals another story: a criminal software business that appears to have become increasingly difficult for its original operator to control.
Posts reviewed by Flare show the channel presenting itself as BTMOB’s official outlet continuing to release new versions and sell access, private infrastructure, and source code. Around it, other actors advertise cheaper subscriptions, reseller panels, purported source files, and versions carrying the BTMOB name.
To understand how this ecosystem developed, the research examined thousands of posts from forums and chat platforms, following BTMOB’s underground activity from its early stages in 2025 through the present.
The material includes announcements from the apparent official operation, alongside activity by resellers, source-code vendors, and other actors using the BTMOB name.
Key points
BTMOB developed from a centrally operated malware service into a broader ecosystem involving private servers, source-code buyers, custom versions, and independent administrators.
The official operator repeatedly reduced the price, while third parties advertised alleged access and source files at substantially lower prices.
The BTMOB name is now used by coordinated reseller campaigns and accounts that imply an official connection, although the authenticity of many offers cannot be verified.
... continue reading