Threat reportMalwareTL-2026-4586
Malicious Android Apps (ZloyRAT, RedWing Stealer) Lure Russian Users via Fuel-Price and Drone-Strike Anxiety
Malicious Android Apps (ZloyRAT, RedWing Stealer) Lure (TL-2026-4586), also tracked as ZloyRAT, is a medium-severity malware campaign, first published 2026-10-28. It has no confirmed attribution, affects Google Android (sideloaded applications), maps to 15 MITRE ATT&CK techniques (T1417.001, T1417.002, T1437.001), and is covered by 9 detection rules and 12 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 15MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-4586
- Threat ID
- TL-2026-4586
- Also known as
- ZloyRAT, RedWing Stealer, RadarTrevog
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, transport, logistics, government administration, retail
- Target regions
- russia
- Detection rules
- 9
- Indicators of compromise
- 12
Malware and tooling in Malicious Android Apps (ZloyRAT, RedWing Stealer) Lure
Malware and tooling: RedWing, RedWing Stealer, ZloyRAT, telegram
How Malicious Android Apps (ZloyRAT, RedWing Stealer) Lure works
F6 reports fake Android apps posing as a DPS (traffic police) radar with fuel availability, a 'government' VPN (GosuVPN) and a drone-attack radar that deliver the ZloyRAT trojan to Russian drivers, truck drivers, taxi and delivery workers. A related RedWing Stealer variant (800+ samples) was spread as the 'RadarTrevog' air-raid alert app; both abuse SMS, contacts and call permissions to steal banking and messenger data.
In October 2026 F6 (CERT F6 / F6 Threat Intelligence) disclosed a campaign distributing the Android trojan ZloyRAT, which F6 first detected in the first half of 2026. The operators published a single .online website, created on 2026-10-04, hosting three dropper apps: 'ДПС радар. Топливо онлайн' (DPS Radar. Fuel Online), advertised as showing real-time traffic police positions, speed cameras and fuel availability; 'GosuVPN', advertised as a free state-backed VPN service; and 'Радар БПЛА' (Drone Radar), advertised as a real-time interactive map of drone attacks. The apps were promoted in chats, channels and communities of drivers, including logistics, taxi, delivery and car-sharing groups, and via messenger links, SMS and forum posts. After F6 notified authorities the site was blocked in Russia. F6 reports that earlier traffic-police radar apps with malicious payloads were seen from autumn 2025 and fuel-availability lures from summer 2026.
Once installed, the dropper installs the main payload, which disguises itself as a legitimate app and requests permissions for SMS processing, contacts and phone calls. ZloyRAT can read incoming SMS and push notifications, exfiltrate the contact list, send SMS messages and USSD commands, and place calls to numbers chosen by the attackers. It targets data tied to more than 60 Russian banking and financial apps, online marketplaces, government service apps and Telegram.
F6 links the campaign to its earlier RedWing findings. Between summer and September 2026 F6 observed the RedWing Stealer variant of the RedWing family distributed as 'RadarTrevog', an app posing as an official drone/missile alert service with fake positive reviews, siren sounds, multi-location tracking and a 'family mode'. F6 identified more than 800 RedWing Stealer samples disguised as drone radars, fuel maps, adult video services, VPNs and game cheats/mods, and reported more than 10,000 infected devices between mid-July and mid-September 2026. Distribution domains reported for RadarTrevog were radar-trevog.ru (created 2026-07-20) and radar-trevoga.ru (created 2026-08-03). Zimperium zLabs documented RedWing in July 2026 as a Telegram-sold Malware-as-a-Service for Android: HTTP/WebSocket C2 with 200+ commands, dropper constructor with fake Google Play / Galaxy Store / AppGallery / RuStore pages, Accessibility Service abuse, VNC-style screen streaming, keylogging, overlay injects against 82 financial targets, default-SMS-handler abuse for OTP interception, USSD call-forwarding (*21*) and DDoS capability. Zimperium notes links to Russian-speaking actors and dropper similarities to Oblivion RAT. No threat actor is attributed to the ZloyRAT campaign; the RedWing capability list is Zimperium's description of the MaaS family and is not independently confirmed by F6 for the ZloyRAT payload. The ZloyRAT .online domain, package names and file hashes were not published in the sources reviewed.
MITRE ATT&CK techniques used in TL-2026-4586
Collection
T1417.001 Keylogging; T1513 Screen Capture; T1517 Access Notifications; T1636.003 Contact List; T1636.004 SMS Messages
Credential Access
Command and Control
T1437.001 Web Protocols; T1481.002 Bidirectional Communication
Defense Evasion
T1516 Input Injection; T1655.001 Match Legitimate Name or Location
Impact
T1582 SMS Control; T1616 Call Control
Persistence
Exfiltration
T1646 Exfiltration Over C2 Channel
Initial Access
Affected products and versions in Malicious Android Apps (ZloyRAT, RedWing Stealer) Lure
- Google — Android (sideloaded applications)
Vulnerable versions: Devices on which users install malicious APKs and grant SMS, contacts, phone or Accessibility permissions
Remediation for Malicious Android Apps (ZloyRAT, RedWing Stealer) Lure
Immediate actions
- Do not install APKs from driver chats, Telegram channels, forums or messenger links; install apps only from official stores
- Remove 'ДПС радар. Топливо онлайн', GosuVPN, 'Радар БПЛА' / Drone Radar and RadarTrevog apps and revoke SMS, contacts, phone and accessibility permissions
- If an infected device was used for banking, change banking and Telegram credentials from a clean device and contact the bank
- Block the identified distribution domains (radar-trevog.ru, radar-trevoga.ru) at DNS and web proxies
Workarounds
- Disable 'install unknown apps' for browsers and messengers on managed devices
- Restrict USSD and call-forwarding changes where the carrier or MDM allows
Longer-term hardening
- Deploy mobile threat defense / MDM controls that flag sideloaded apps, default-SMS-handler changes and Accessibility Service grants
- Run awareness training for drivers and fleet operators on fake radar, fuel, VPN and drone-alert apps
- Prefer app-based or hardware second factors over SMS OTP for banking
Timeline of Malicious Android Apps (ZloyRAT, RedWing Stealer) Lure
- Zimperium zLabs publishes its analysis of RedWing, a Telegram-sold Android Malware-as-a-Service with 82 financial targets and links to Russian-speaking actors.
- Distribution domain radar-trevog.ru for the 'RadarTrevog' fake air-raid alert app is created (later blocked).
- Second RadarTrevog distribution domain radar-trevoga.ru is created (later taken down).
- F6 publishes that RedWing Stealer is being distributed as the 'RadarTrevog' drone-alert app; more than 800 RedWing Stealer samples identified.
- Russian press reports F6 data showing more than 10,000 devices infected with RedWing between mid-July and mid-September 2026.
- A .online website hosting the ZloyRAT dropper apps (DPS Radar. Fuel Online, GosuVPN, Radar BPLA) is registered.
- F6 publishes its ZloyRAT report; the distribution site is blocked in Russia after CERT F6 notification.
- The Record reports F6's findings on malicious apps exploiting fuel-price and drone-strike anxiety.
Sources cited for Malicious Android Apps (ZloyRAT, RedWing Stealer) Lure
- Malicious apps prey on Russians' anxiety about fuel prices, drone strikes (The Record)
- F6 press release: ZloyRAT
- Злое комбо: под видом приложения-радара ДПС и наличия бензина распространяют Android-троян ZloyRAT (F6 on Habr)
- Злое комбо ... ZloyRAT (CNews)
- F6 выявила Android-троян ZloyRAT под видом радара (CISOClub)
- Приложение «ДПС радар» читает ваши СМС и звонит без спроса (SecurityLab)
- F6: под видом мобильного приложения для оповещений о воздушных атаках распространяют Android-троян (Vedomosti press release, RadarTrevog)
- RedWing: A Mobile Malware-as-a-Service Operation (Zimperium zLabs)
- Zimperium RedWing IOC repository
- RedWing MaaS packages Android bank-fraud tooling (The Hacker News)
- Троян RedWing сам разблокирует Android-смартфон (Anti-Malware.ru)
Detection coverage for TL-2026-4586
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4586 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.