Octagon Android RAT — Fake Bahrain Civil Defense App Targets Mobile Endpoints via Multi-Stage Payload — Threadlinqs Intelligence
As of 2026-08-05, Octagon Android RAT — Fake Bahrain Civil Defense App Targets Mobile Endpoints via Multi-Stage Payload is a critical-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 47 indicators of compromise.
Threat ID: TL-2026-1881 · Severity: CRITICAL · Status: ACTIVE · Category: MALWARE
Zimperium zLabs and K7 Labs report Octagon, an emerging multi-stage Android RAT distributed via fake 'BH Alert' Civil Defense apps impersonating Bahrain government emergency-communication services.
Octagon is a multi-stage Android Remote Access Trojan first publicly named by K7 Computing Labs (author: Baran S., published 2026-08-03) and independently documented by Zimperium zLabs the following day. The campaign impersonates the official 'BH Alert' civil-defense/emergency application used by Bahrain's Ministry of Interior and UNDRR, and is delivered through a phishing infrastructure of fake Google Play pages and spoofed government download sites that serve a 20 MB 'BH-Alert.apk' outside official app stores. The primary dropper (package com.kit.kitty) creates a launcher icon mimicking the legitimate MyGov – Bahrain app and walks victims through a 7-step setup wizard that coerces several dangerous permissions: Accessibility Service, VPN, 'Install Unknown Apps', and standard SMS/contacts grants.
The malware employs a four-stage decoupled architecture. Stage 0 (com.old.stem.Ematterassist) is an outer RC4 shell (key 'ct') that injects the BH Alert installer DEX; Stage 1 (com.kit.kitty) is the lure that coerces permissions and installs the child APK; Stage 2 (biz.rely.melt.Hvoicemanual) is a nested RC4 shell (key 'NYrGT') that injects the core RAT DEX; Stage 3 (com.kisa.octagonpanel) is the operational RAT. Payload DEX is encrypted as a disguised font file (assets/ZfChs.ttf), decrypted on-device via an RC4 routine, written to private storage as ZfChs.dex, and loaded at runtime with DexClassLoader — resolving manifest class declarations that do not exist in the primary classes.dex to defeat static analysis. End-to-end C2 traffic is protected with AES-256-GCM (256-bit key derived via SHA-256 of passphrase 'octagon-default-key-change-me', 12-byte nonce, 128-bit auth tag), with build ID 'DevLRT' and protocol version 2.
After obtaining VPN permission, the FenrirVpnService establishes a malicious VPN tunnel assigning 10.0.0.1/24 with default routes and advertised DNS, but processPacket always returns null — routing all device traffic except an allow-listed set of apps (messengers, social apps, the malware packages) into a blackhole, enabling network-layer traffic interception and hijacking while the device appears functional for excluded apps. The child RAT is installed in-memory via Android PackageInstaller sessions without writing a standalone APK to disk, then launches com.kisa.octagonpanel, which generates and dynamically loads ZGdSEl.jar via dex2oat.
OctagonPanel's surveillance capabilities include: Accessibility-based keylogging of lock-screen PINs/passwords/patterns (LockscreenPasswordCapture, stored in captured_passwords.json with a 200-entry rolling history), SMS/WAP interception with default-SMS-app registration (SmsReceiver, WapPushReceiver, HeadlessSmsSendService), contact and call-log harvesting, screen capture via Accessibility and MediaProjection, real-time UI-overlay phishing (GateOverlayActivity launching on foreground-package match against an operator-controlled gate list), and remote UI control (node actions, package launch, click triggers, watchers, screen dimming). Stolen data is persisted in a local SQLite database (octagon_ward.db) for operation during network interruptions and synced to C2 later.
Persistence is defense-in-depth: boot receivers (BOOT_COMPLETED), a ServiceWatchdog combining AlarmManager, WorkManager and expedited restart paths, a GuardService in a separate :guard process, an anti-removal monitor (anti_remover/anti_remover_moni), and a SyncHelper that registers a fake 'OctagonPanel' account via Android AccountManager/SyncAdapter framework to wake the malware every 30 minutes — preserving runtime state, C2 config, and removal resistance across reboots. C2 is 209.99.184.50:4444 (non-standard port), with a secondary launcher host www.murlauncher.com/fenrir-launcher and a Guardian protocol (types 48-65) that can swap C2 infrastructure on demand. Attribution is unconfirmed; DreamGroup notes Russian-speaking actor indicators (Cyrillic strings, 'kisa' shared across package names) but explicitly stat
Target sectors: public-safety, civil-defense, government administration, general-public, telecoms
Target regions: Middle East, bahrain
Detections & IOCs
As of 2026-08-25, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 47 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
4 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, CRITICAL, threat intelligence, cybersecurity, T1660, T1407, T1429, T1624, T1603, T1541, T1626, T1406, T1628, T1629
