Bymox
Bymox is a threat actor group with an ideological motive, tracked by Brandefense.
- Techniques
- 0
- Exploited CVEs
- No CVE data
- Record updated
About Bymox.
The threat actor known by the codename "bymox," previously identified as "Bymoxia," was first detected on an illegal forum on April 14, 2021. With a medium reputation score of 145, the actor has engaged in activities such as distributing Android RATs, extracting funds from banking applications, selling credit card data, and trading banking customer information. Operating primarily in the banking and finance sectors, their activities target regions in Asia and Europe, with a specific focus on Turkey. Their known malicious software arsenal includes Ermac v3.0, G700 RAT, Phoenix, Octo, and Craxs. Communication channels linked to this individual include Telegram accounts under names such as Bymoxia, AndroidBanklogin, and ByMoxcrpyter. With a total of 42 threads and 615 messages on the platform, their motivation appears to center around financial gain and building reputation within the cybercriminal community.
Last updated May 14, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.