**BTMOB** is an **Android** Remote Access Trojan (RAT) designed to steal information and provide remote control over victim devices. It's sold as a malware-as-a-service package, providing malicious application builders, a Windows-based operator panel, server infrastructure, and tools for phishing and credential theft. While **BTMOB** has been extensively covered for its technical capabilities, its operational ecosystem remained less understood. **Flare** researchers, through analysis of underground forums and chat platforms, have uncovered a criminal software business struggling with fragmentation and a burgeoning secondary market. ### The Rise of a Fragmented Market **Flare**'s findings indicate that the official **BTMOB** channel continues to release new versions and sell access, private infrastructure, and source code. However, a parallel market has emerged, with other actors advertising cheaper subscriptions, reseller panels, and purported source files, often using the **BTMOB** name without official endorsement. Key observations from **Flare**'s research include: * **BTMOB** transitioned from a centralized service to a broader ecosystem with private servers, source code buyers, custom versions, and independent administrators. * The official operator repeatedly lowered prices, while third parties offered alleged access and source files at significantly reduced rates. * The **BTMOB** name is now exploited by coordinated reseller campaigns and accounts implying official connections, though authenticity is often unverified. * The official **BTMOB** operation persists even as this secondary market flourishes, continuing to develop and advertise its services. ### Infrastructure Challenges and Strategic Shifts In January 2025, the official **BTMOB** channel offered **BTMOB V2** for $700/month or a $3,000 lifetime license, with private infrastructure and support costing an additional $5,000 plus monthly fees. Shortly after, the operator acknowledged server errors, claiming over 4,000 connected mobile devices were causing heavy traffic, potentially due to customer activity or a DDoS attack.   These early issues highlight the official operator's direct management of shared infrastructure and customer communications. ### Selling the Core: Source Code Distribution By May 2025, the official channel began offering the complete **BTMOB** source code and setup tutorials for $20,000. This package included **PHP** and **Node.js** server components, a **VB.NET** control panel, and **Java Android** code.  The operator justified this move by stating it would generate profit, allow customers to inspect the code, and enable custom versions without halting original service development.  Simultaneously, the organization showed signs of internal discord. A Spanish- and Portuguese-language support channel reported server downtime due to a dispute with former administrators, leading to suspended sales and accusations of bad faith. By July, the main channel announced administrators would operate independently, and a Brazilian administrator had purchased the source code for a separate version. Consequently, the advertised source code price dropped to $10,000. When **BTMOB V4** launched in December, the focus shifted to lifetime access, private servers, custom versions, and recurring fees. ### The Rise of a Cheaper Secondary Market During this period, a coordinated **Telegram** campaign began offering **BTMOB V4.1.2** and **V4.2** access. Advertisements offered lifetime access for $500 and "RAT and server file source code" for $1,500, directing buyers to specific contact handles. These ads were widely distributed across multiple **Telegram** groups, often with identical wording and pricing. On April 26, the main **BTMOB** channel issued a warning, stating it had only one official channel and disclaiming responsibility for other accounts claiming to represent the project. This suggests the official operators were aware of, and concerned by, the proliferation of unofficial sellers.  Other actors further undercut prices, offering various **BTMOB** versions through weekly, monthly, and lifetime plans, including alleged source code. Some even invited customers to become **BTMOB** sellers by purchasing inexpensive user or administrator panels. This fragmentation of the **BTMOB** ecosystem illustrates a common challenge in the criminal underground: as a successful malware service gains traction, it becomes increasingly difficult for its original creators to maintain control, leading to a sprawling and often chaotic secondary market.