# Malicious Android Apps (ZloyRAT, RedWing Stealer) Lure Russian Users via Fuel-Price and Drone-Strike Anxiety

> F6 reports fake Android apps posing as a DPS (traffic police) radar with fuel availability, a 'government' VPN (GosuVPN) and a drone-attack radar that deliver the ZloyRAT trojan to Russian drivers, truck drivers, taxi and delivery workers. A related RedWing Stealer variant (800+ samples) was spread as the 'RadarTrevog' air-raid alert app; both abuse SMS, contacts and call permissions to steal banking and messenger data.

- **Published:** 2026-10-28T01:43:11Z
- **Last reviewed:** 2026-10-28T01:43:11Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4586
- **ID:** TL-2026-4586
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In October 2026 F6 (CERT F6 / F6 Threat Intelligence) disclosed a campaign distributing the Android trojan ZloyRAT, which F6 first detected in the first half of 2026. The operators published a single .online website, created on 2026-10-04, hosting three dropper apps: 'ДПС радар. Топливо онлайн' (DPS Radar. Fuel Online), advertised as showing real-time traffic police positions, speed cameras and fuel availability; 'GosuVPN', advertised as a free state-backed VPN service; and 'Радар БПЛА' (Drone Radar), advertised as a real-time interactive map of drone attacks. The apps were promoted in chats, channels and communities of drivers, including logistics, taxi, delivery and car-sharing groups, and via messenger links, SMS and forum posts. After F6 notified authorities the site was blocked in Russia. F6 reports that earlier traffic-police radar apps with malicious payloads were seen from autumn 2025 and fuel-availability lures from summer 2026.

Once installed, the dropper installs the main payload, which disguises itself as a legitimate app and requests permissions for SMS processing, contacts and phone calls. ZloyRAT can read incoming SMS and push notifications, exfiltrate the contact list, send SMS messages and USSD commands, and place calls to numbers chosen by the attackers. It targets data tied to more than 60 Russian banking and financial apps, online marketplaces, government service apps and Telegram.

F6 links the campaign to its earlier RedWing findings. Between summer and September 2026 F6 observed the RedWing Stealer variant of the RedWing family distributed as 'RadarTrevog', an app posing as an official drone/missile alert service with fake positive reviews, siren sounds, multi-location tracking and a 'family mode'. F6 identified more than 800 RedWing Stealer samples disguised as drone radars, fuel maps, adult video services, VPNs and game cheats/mods, and reported more than 10,000 infected devices between mid-July and mid-September 2026. Distribution domains reported for RadarTrevog were radar-trevog.ru (created 2026-07-20) and radar-trevoga.ru (created 2026-08-03). Zimperium zLabs documented RedWing in July 2026 as a Telegram-sold Malware-as-a-Service for Android: HTTP/WebSocket C2 with 200+ commands, dropper constructor with fake Google Play / Galaxy Store / AppGallery / RuStore pages, Accessibility Service abuse, VNC-style screen streaming, keylogging, overlay injects against 82 financial targets, default-SMS-handler abuse for OTP interception, USSD call-forwarding (*21*) and DDoS capability. Zimperium notes links to Russian-speaking actors and dropper similarities to Oblivion RAT. No threat actor is attributed to the ZloyRAT campaign; the RedWing capability list is Zimperium's description of the MaaS family and is not independently confirmed by F6 for the ZloyRAT payload. The ZloyRAT .online domain, package names and file hashes were not published in the sources reviewed.

## MITRE ATT&CK

- T1660 Phishing
- T1655.001 Match Legitimate Name or Location
- T1624.001 Broadcast Receivers
- T1516 Input Injection
- T1636.004 SMS Messages
- T1636.003 Contact List
- T1517 Access Notifications
- T1417.001 Keylogging
- T1417.002 GUI Input Capture
- T1513 Screen Capture
- T1582 SMS Control
- T1616 Call Control
- T1437.001 Web Protocols
- T1481.002 Bidirectional Communication
- T1646 Exfiltration Over C2 Channel

## Sources

- [Malicious apps prey on Russians' anxiety about fuel prices, drone strikes (The Record)](https://therecord.media/malicious-apps-russian-anxiety-gas-prices-drone-strikes)
- [F6 press release: ZloyRAT](https://www.f6.ru/media-center/press-releases/zloyrat/)
- [Злое комбо: под видом приложения-радара ДПС и наличия бензина распространяют Android-троян ZloyRAT (F6 on Habr)](https://habr.com/ru/companies/F6/news/1099372/)
- [Злое комбо ... ZloyRAT (CNews)](https://safe.cnews.ru/news/line/2026-10-26_zloe_kombo_pod_vidom_prilozheniya-radara)
- [F6 выявила Android-троян ZloyRAT под видом радара (CISOClub)](https://cisoclub.ru/zloe-kombo-pod-vidom-prilozhenija-radara-dps-i-nalichija-benzina-rasprostranjajut-android-trojan-zloyrat)
- [Приложение «ДПС радар» читает ваши СМС и звонит без спроса (SecurityLab)](https://www.securitylab.ru/news/579240.php)
- [F6: под видом мобильного приложения для оповещений о воздушных атаках распространяют Android-троян (Vedomosti press release, RadarTrevog)](https://www.vedomosti.ru/press_releases/2026/08/12/f6-pod-vidom-mobilnogo-prilozheniya-dlya-opoveschenii-o-vozdushnih-atakah-rasprostranyayut-android-troyan)
- [RedWing: A Mobile Malware-as-a-Service Operation (Zimperium zLabs)](https://zimperium.com/blog/redwing-a-mobile-malware-as-a-service-operation)
- [Zimperium RedWing IOC repository](https://github.com/Zimperium/IOC/tree/master/2026-07-RedWing)
- [RedWing MaaS packages Android bank-fraud tooling (The Hacker News)](https://thehackernews.com/2026/07/redwing-maas-packages-android-bank.html)
- [Троян RedWing сам разблокирует Android-смартфон (Anti-Malware.ru)](https://www.anti-malware.ru/news/2026-09-24-111332/51521)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4586