HummingBad

Linked to China by two sources.

Reports: 8
Last reported: 19 April 2026
Known CVEs: 2
Origin: China

ID: hummingbad
Sources: MISP Malpedia
Merge evidence: 1 alias match

Reports per quarter

2016 Q3: 1 report
2016 Q4: 1 report
2017 Q1: no reports
2017 Q2: no reports
2017 Q3: no reports
2017 Q4: no reports
2018 Q1: no reports
2018 Q2: no reports
2018 Q3: no reports
2018 Q4: no reports
2019 Q1: no reports
2019 Q2: no reports
2019 Q3: no reports
2019 Q4: no reports
2020 Q1: no reports
2020 Q2: no reports
2020 Q3: no reports
2020 Q4: no reports
2021 Q1: no reports
2021 Q2: no reports
2021 Q3: no reports
2021 Q4: no reports
2022 Q1: no reports
2022 Q2: no reports
2022 Q3: no reports
2022 Q4: no reports
2023 Q1: no reports
2023 Q2: no reports
2023 Q3: no reports
2023 Q4: no reports
2024 Q1: no reports
2024 Q2: no reports
2024 Q3: no reports
2024 Q4: no reports
2025 Q1: no reports
2025 Q2: no reports
2025 Q3: no reports
2025 Q4: no reports
2026 Q1: no reports
2026 Q2: 6 reports

Dated reports, 2016 Q3 to 2026 Q2.

CVEs named in reports

CVE-2013-6282 KEV
CVE-2014-3153 KEV

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

19 April 2026

A Whale of a Tale: HummingBad Returns

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor A Whale of a Tale: HummingBad Returns
13 April 2026

More Than 1 Million Google Accounts Breached by Gooligan

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor More Than 1 Million Google Accounts Breached by Gooligan
6 April 2026

Hummingbad

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Hummingbad
6 April 2026

Virulent Android malware returns, gets >2 million downloads on Google Play

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Virulent Android malware returns, gets >2 million downloads on Google Play
6 April 2026

HummingBad: A Persistent Mobile Chain Attack

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor HummingBad: A Persistent Mobile Chain Attack
6 April 2026

10 million Android phones infected by all-powerful auto-rooting apps

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor 10 million Android phones infected by all-powerful auto-rooting apps
13 December 2016

Word Template

file creation date fromORKL

Archived copy on ORKL Detailsfor Word Template
1 July 2016

Word Template

Malpedia library date Check Point fromORKLCCS '25 data

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Word Template

Newest first. Details opens the report in Explore.