RedHook Android RAT Abuses ADB Wireless Debugging and Embedded Shizuku Code for Non-Root Shell-Level Access (uid 2000)

Key facts for RedHook Shizuku ADB shell RAT

Detection coverage for RedHook Shizuku ADB shell RAT

As of 2026-07-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1146 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: RedHook C2 Beacon and RTMP-Bypass Screen-Streaming to 3n7wj.com Domain Family

Detects the C2/lateral-movement stage where an infected device beacons its WebSocket/REST command channel and RTMP-style screen-streaming traffic to the api./skt./sktv.3n7wj.com domain family, bypassing the MediaProjection consent dialog while exfiltrating device info, keystrokes, passwords, and messages.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1071, T1573, T1105, T1041, T1113, T1125
• Data sources: network_dns, proxy_logs, firewall_logs, mobile_network_connection
• Severity: critical
• Confidence: high

Splunk SPL

index=network sourcetype="dns" query{}.endswith=".3n7wj.com*"
| append [ search index=network sourcetype="proxy" OR sourcetype="firewall" dest_host{}.endswith=".3n7wj.com*" ]
| eval c2_role=case(match(query,"^api\."), "REST_C2", match(query,"^skt\."), "WS_COMMAND", match(query,"^sktv\."), "RTMP_STREAM", true(), "unknown")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, query, c2_role
| table first_seen, last_seen, src_ip, query, c2_role

Microsoft KQL

DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has "3n7wj.com" or RemoteUrl has_any ("api.3n7wj.com", "skt.3n7wj.com", "sktv.3n7wj.com")
| extend C2Role = case(RemoteUrl has "api.3n7wj.com", "REST_C2", RemoteUrl has "skt.3n7wj.com", "WS_COMMAND", RemoteUrl has "sktv.3n7wj.com", "RTMP_STREAM", "unknown")
| project Timestamp, DeviceId, DeviceName, RemoteUrl, RemoteIP, C2Role
| summarize count(), min(Timestamp), max(Timestamp) by DeviceId, RemoteUrl, C2Role

Sigma

title: RedHook C2 Command-Table Beacon over WebSocket/REST to 3n7wj.com Domain Family
id: 9e3c4032-3c4d-4e5f-b06b-c32d4e5f6071
status: experimental
description: Detects DNS/network traffic to the api./skt./sktv.3n7wj.com C2 domain family used by RedHook for command delivery and RTMP-bypass screen streaming.
references:
  - https://www.group-ib.com/blog/redhook-android-rat-upgraded/
  - https://cybersecuritynews.com/redhook-android-rat-abuses-adb-wireless-debugging/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-09
tags:
  - attack.command-and-control
  - attack.t1071.001
  - attack.t1573
  - attack.t1105
  - attack.exfiltration
  - attack.t1041
  - attack.tool.redhook
logsource:
  category: dns_query
detection:
  selection:
    query|endswith: '.3n7wj.com'
  condition: selection
falsepositives:
  - None known; 3n7wj.com is a dedicated malicious C2 domain family with no legitimate business use
level: critical

Known false positives:

• None known — 3n7wj.com has no legitimate business use; monitor for DNS-sinkhole or security-vendor scanning traffic which can be excluded by known scanner ASN allow-list

Tuning notes: Add the full IOC set (api./skt./sktv.3n7wj.com) to DNS/proxy blocklists in addition to alerting; correlate RTMP_STREAM role hits with absence of a corresponding MediaProjection consent-dialog event to confirm the bypass.

• 🔒 RedHook Phishing-Delivered APK Sideload from GitHub/S3 Fake Play Store Sites · unlock with TL Creds
• 🔒 RedHook BOOT_COMPLETED Wireless-ADB Re-Enable and Mutual Service Resurrection Persistence · unlock with TL Creds
• 🔒 RedHook Autonomous Permission Grant and Silent App Install/Uninstall via C2 Command Table · unlock with TL Creds
• 🔒 RedHook Fake Verification Window Triggering Front-Camera Facial Capture (Command 10023) · unlock with TL Creds
• 🔒 RedHook Invisible 1x1-Pixel Foreground Activity with MediaSession Wake-Lock Abuse · unlock with TL Creds
• 🔒 RedHook WebSocket Numbered Command Payload Preceding Unconsented Device-State Change · unlock with TL Creds
• 🔒 RedHook Accessibility-Driven Wireless ADB / Developer Options Enablement · unlock with TL Creds
• 🔒 RedHook Shizuku-Style Loopback ADB Self-Pairing to uid 2000 Shell · unlock with TL Creds

Indicators of compromise for RedHook Shizuku ADB shell RAT

As of 2026-07-09, Threadlinqs Intelligence tracks 23 indicators of compromise for TL-2026-1146.

Sample indicators (2 of 23)

• Domain: 3n7wj[.]com
• File hash: 453333bffdd1850ea2e0647f7c805530b578919978a01b1e2be52d6eb2add946

Defanged, TLP:CLEAR. Full set of 23 indicators: unlock with TL Creds.

How RedHook Shizuku ADB shell RAT works

RedHook is an Android RAT, first documented by Cyble in July 2025 and re-emerged with upgraded capabilities as of July 2026, that uses social engineering (vishing, Zalo messages, fake Google Play sites) to install a malicious APK, then abuses Accessibility Service automation to silently enable Developer Options and Wireless ADB, self-pairs an embedded ADB client over the loopback interface, and launches a privileged server (libmx.so) using code from the open-source Shizuku framework to obtain shell-level access as uid 2000 without rooting the device.

RedHook is distributed via a multi-stage social-engineering infection chain: operators impersonate government officials or bank support staff over phone calls and the Zalo messaging app, directing victims to fraudulent websites mimicking the Google Play Store. The malicious APK is hosted on GitHub repositories and AWS S3 buckets for delivery resilience. Once installed, RedHook presents phishing UI screens to harvest credentials and personal information, then walks the victim through enabling Accessibility Service under the pretext of unlocking "full features and functionality."

With Accessibility Service granted, RedHook automates the classic seven-tap sequence on the build number to unlock Developer Options, enables Wireless Debugging, and silently extracts the pairing code, all while an overlay screen obscures the process from the victim. It then launches an embedded ADB client that connects to the device's own ADB daemon over the loopback interface (127.0.0.1) and, using code lifted from the legitimate open-source Shizuku project (normally used by Android power users to gain elevated app permissions without rooting), spawns a privileged server process (libmx.so) running as uid 2000 (shell). This grants the malware the ability to grant itself runtime permissions, execute arbitrary shell commands, and silently install or remove other applications without any security prompts or user confirmation.

Once privileged, RedHook can stream the victim's screen over RTMP in parallel with — and bypassing — the Android MediaProjection API and its mandatory consent dialog, in addition to keylogging, screen-lock credential theft, contact/SMS/app-list enumeration, and UI node-tree collection. A command table of roughly 53 numbered operations (e.g., 10001 device info, 10010/10011 APK install/uninstall, 10018/10019 screen capture and layout monitoring, 10023 a fake verification window that triggers the front camera to capture the victim's face, 10028/10029 disable/enable Accessibility, 10050/10051 ADB setup, 10054 autonomous permission grant, 99999 uninstall of the helper library) is issued over a WebSocket command channel and REST API rooted at api.3n7wj[.]com.

Persistence is multi-layered: a near-invisible 1x1-pixel foreground Activity misclassifies the app as a high-priority foreground process to dodge Android's OOM killer; a silent MediaSession audio stream and a foreground-service wake lock keep the process alive; the process writes -1000 to /proc/<pid>/oom_score_adj; two internal services are mutually bound via bindService()/BIND_AUTO_CREATE and resurrect one another if either is killed, verified by a 5-minute alarm; and a BOOT_COMPLETED receiver silently re-enables Wireless ADB and restores shell privileges within seconds of every reboot.

Dormant, brand-specific automation routines for Google, Huawei, Meizu, Oppo, Samsung, Vivo, and Xiaomi devices were identified in the sample but are not yet active, indicating the operators are staging OEM-specific attack paths for future campaigns. The malware originally targeted victims in Vietnam; the July 2026 resurgence shows expansion into Indonesia with broader Southeast Asia targeting indicated. No CVE has been assigned — RedHook abuses legitimate, intended Android developer functionality (Wireless Debugging) rather than exploiting a software vulnerability, so there is no vendor patch; mitigation is behavioral (disable Developer Options/Wireless Debugging outside development use, restrict Accessibility Service grants, vet APK sources).

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1056 Input Capture; T1113 Screen Capture; T1125 Video Capture

Defense Evasion

T1036 Masquerading; T1564 Hide Artifacts

Exfiltration

T1041 Exfiltration Over C2 Channel

Persistence

T1053 Scheduled Task/Job; T1547 Boot or Logon Autostart Execution

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1573 Encrypted Channel

Discovery

T1082 System Information Discovery; T1518 Software Discovery

Execution

T1204 User Execution

Privilege Escalation

T1548 Abuse Elevation Control Mechanism

Credential Access

T1555 Credentials from Password Stores

Initial Access

T1566 Phishing

Resource Development

T1583 Acquire Infrastructure; T1608 Stage Capabilities

Reconnaissance

T1598 Phishing for Information

defense-impairment

T1685 Disable or Modify Tools

Remediation for RedHook Shizuku ADB shell RAT

Immediate actions

• Disable Developer Options and Wireless Debugging on production/end-user Android devices; audit for unexpectedly enabled ADB Wireless Debugging
• Block network traffic to api.3n7wj[.]com, skt.3n7wj[.]com, and sktv.3n7wj[.]com at DNS/proxy/firewall layer
• Force-uninstall APKs matching SHA-256 453333bffdd1850ea2e0647f7c805530b578919978a01b1e2be52d6eb2add946 and any process spawning libmx.so or mx_server
• Revoke Accessibility Service grants for unrecognized or recently sideloaded applications
• Alert users in Vietnam and Indonesia (banking/government customer bases) about vishing calls and Zalo messages impersonating officials or bank support

Workarounds

• No CVE/vendor patch exists — RedHook abuses legitimate Android developer functionality rather than a vulnerability; mitigation is configuration and behavior-based (see immediate/long_term actions)

Longer-term hardening

• Deploy mobile threat defense (MTD) / EDR with behavioral detection for Accessibility Service abuse and anomalous ADB/Wireless Debugging state changes
• Implement digital risk protection to detect brand impersonation (fake Google Play sites, spoofed government/bank domains)
• Enforce Android Enterprise / MDM policies that block installation from unknown sources and restrict Developer Options on managed devices
• Monitor for RTMP and WebSocket egress from mobile endpoints as a screen-streaming indicator that bypasses MediaProjection consent
• Session-monitoring for financial institutions to detect device-takeover patterns consistent with silently-granted shell-level access

Affected and fixed versions

• Google — Android OS (Wireless Debugging / Developer Options feature, Accessibility Service API)
  Vulnerable versions: Android 11; Android 12; Android 13; Android 14; Android 15

Timeline of RedHook Shizuku ADB shell RAT

• 2025-07-01 locked-ioc-12 first documented by locked-ioc-23 researchers, targeting victims in Vietnam via social-engineering-delivered malicious APKs.
• 2026-07-09 Researchers document locked-ioc-20's use of parallel RTMP screen/video streaming to bypass the Android MediaProjection API and its mandatory consent dialog once shell privileges are obtained.
• 2026-07-09 Analysts identify dormant, brand-specific automation routines for Google, Huawei, Meizu, Oppo, Samsung, Vivo, and Xiaomi devices in the sample, not yet active but reserved for future OEM-targeted campaigns.
• 2026-07-09 Targeting expands beyond Vietnam to include victims in Indonesia, with researchers indicating a broader push across Southeast Asia.
• 2026-07-09 C2 infrastructure identified under the locked-ioc-15 domain family, comprising a REST API (api.locked-ioc-15) and two WebSocket endpoints (skt.locked-ioc-15 for commands, sktv.locked-ioc-15 for screen streaming).
• 2026-07-09 Researchers disclose that locked-ioc-20 automates enabling Developer Options and Wireless Debugging via Accessibility Service, self-pairs an locked-ioc-13 over loopback, and integrates code from the open-source locked-ioc-21 framework to obtain shell-level access as uid 2000 without rooting the device.
• 2026-07-09 Analysts publish the full ~53-entry numbered C2 command table issued over the WebSocket/REST channel rooted at api.locked-ioc-15, including device info collection, silent APK install/uninstall, screen/layout monitoring, Accessibility toggling, ADB setup, and autonomous permission granting.
• 2026-07-09 Researchers detail the multi-stage social-engineering infection chain: operators impersonate government officials or bank support staff via phone calls and Zalo messages, directing victims to fraudulent websites mimicking the Google Play Store to install the malicious APK, which is hosted on locked-ioc-22 repositories and AWS S3 buckets for delivery resilience.
• 2026-07-09 Cyber Security News and locked-ioc-19 report locked-ioc-20 has resurfaced with upgraded capabilities, including a novel ADB Wireless Debugging abuse technique.

Sources cited for RedHook Shizuku ADB shell RAT

• RedHook Returns with a Dangerous Upgrade group-ib.com · Vendor report · 2026-07-09
• Shizuku User Manual shizuku.rikka.app · Vendor report · 2026-07-09
• Automatically activate Shizuku in Android 14+ (non-root) GitHub · Code repository · 2026-07-09
• RedHook Android RAT Abuses ADB Wireless Debugging cybersecuritynews.com · News · 2026-07-09
• Android RAT RedHook Uses Wireless ADB to Silently Grant Permissions and Control Devices cyberpress.org · News · 2026-07-09

Threats related to RedHook Shizuku ADB shell RAT

• RedHook Android RAT Abuses Wireless ADB via Accessibility Service to Gain Shell-Level Device Access

Previous and next in malware

• Fake IT Support Calls on Microsoft Teams Push EtherRAT — Node.js RAT Using EtherHiding (Ethereum Smart Contract C2), Linked to React2Shell (CVE-2025-55182) Exploitation Chain Previous report
• GigaWiper (BLUERABBIT) — Go-Based Modular Backdoor Bundles Raw Disk Wiper, Crucio-Derived Fake Ransomware, and FlockWiper Drive Overwriter Behind Espionage Tooling Next report