Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
The GhostX Ecosystem: Forged in Transit, Licensed to Deceive
Threat Actors
Malware Families
Excerpt
Executive Summary Cyble has continued tracking GhostBat RAT activity targeting Android users in India since its initial identification in October 2025 . Recent investigations into malicious mParivahan and eChallan-themed applications revealed a broader operator-controlled ecosystem that we track as GhostX. Analysis of the exposed GhostX backend identified administrative and user-management structures, device-control records, SMS-delivery instructions, call-forwarding…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(2)
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | https://api.cloudsettle.org/pin-data | High | Score 58/100 | First seen |
| URL | https://api.cloudsettle.org | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…