Cron
Cron is a Russia-attributed cybercrime syndicate with a financial motive, tracked by Brandefense. It targets the Finance sector in 8 countries, including the United States and the United Kingdom.
- Origin
- Russia
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2015
- Record updated
Who They Target.
About Cron.
The Cron malware gang abused the popularity of SMS-banking services and distributed the malware onto victims' Android devices by setting up apps designed to mimic banks' official apps. The gang even inserted the malware into fake mobile apps for popular pornography websites, such as PornHub. After targeting customers of the Bank in Russia, where they were living in, the Cron gang planned to expand its operation by targeting customers of banks in various countries, including the US, the UK, Germany, France, Turkey, Singapore, and Australia. In June 2016, the gang rented a piece of malware called 'Tiny.z' for $2,000 per month, designed to attack customers of Russian banks as well as international banks in Britain, Germany, France, the United States and Turkey, among other countries.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.