Skip to navigation

Threat reportMalwareTL-2026-5346

BTMob Android RAT: February 2026 Source Code Leak Expands Access and Resale

highACTIVE

A February 2026 leak of the BTMob Android remote access trojan's source code on underground forums, including Breach Forums, weakened the original developers' control and allowed independent actors to modify and resell it. BTMob offers live screen monitoring and remote control, SMS/call interception, camera/microphone/GPS access, keylogging, credential capture and silent app installation. First disclosed .

Key facts for BTMob source code leak

IdentifiersTL-2026-5346
Also known asBTMOB, BTMOB RAT, BTMob 4.0
SeverityHIGH
First disclosed
Exploitation statusExploited in the wild
Affected productsGoogle Android
AttributionEVLF (medium confidence)
Nation-state nexusSyria
MalwareBTMOB, BTMOB RAT, CraxsRAT, RemoteControl, SpyNote, SpySolr, telegram
Toolshttp.html_hash:-983012381 port:3000
MITRE ATT&CK techniquesT1406 Obfuscated Files or Information, T1417.001 Input Capture: Keylogging, T1417.002 Input Capture: GUI Input Capture, T1418 Software Discovery, T1429 Audio Capture, T1430 Location Tracking, T1437.001 Application Layer Protocol: Web Protocols, T1512 Video Capture, T1513 Screen Capture, T1516 Input Injection, T1624.001 Event Triggered Execution: Broadcast Receivers, T1628.001 Hide Artifacts: Suppress Application Icon and 4 more in the attack flow
MotivationFINANCIAL
Target sectorsfinance, mobile-users, logistics, streaming-media
Target regionsbrazil, Latin America, Global
Detection rules9 (1 shown free)
Sources10 cited sources

Detection coverage for BTMob source code leak

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5346 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: BTMob Android RAT - Lure, Storefront and C2 Infrastructure Access via Proxy

Detects web proxy traffic from users and managed devices to infrastructure tied to the BTMob (BTMOB RAT) ecosystem: the fake Play Store page, Rodonaves tracking lure, fake banking module host, APK processing platform, official storefront, the confirmed C2 IP 77.111.101.24 and the sample lnat-tv-pro.apk dropper. Phishing-delivered sideloading is the first step of BTMob infection (T1660).

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1660, T1655.001
  • Data sources: proxy:pan:url, palo_alto_url_logs
  • Severity: high
  • Confidence: high

Splunk SPL

index=proxy sourcetype="pan:url" earliest=-24h
```BTMob TL-2026-5346: lure/storefront domains, confirmed C2 IP and sample APK name```
| eval host_l=lower(coalesce(url_domain, url))
| where match(host_l, "(^|[./])(btmobrat[.]net|playstoreapps[.]pro|playstoreap[.]lovable[.]app|rastrear-encomendas2[.]pages[.]dev|meusdownloads[.]site)") OR dest_ip="77.111.101.24" OR like(lower(url), "%lnat-tv-pro.apk%")
| stats count min(_time) as first_seen max(_time) as last_seen values(url) as urls values(http_user_agent) as user_agents by src_ip user dest_ip
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where tolower(RequestURL) matches regex @'(^|[./])(btmobrat\.net|playstoreapps\.pro|playstoreap\.lovable\.app|rastrear-encomendas2\.pages\.dev|meusdownloads\.site)' or DestinationIP == '77.111.101.24' or tolower(RequestURL) contains 'lnat-tv-pro.apk'
| summarize Hits=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Urls=make_set(RequestURL, 20) by SourceIP, SourceUserName, DestinationIP
| project FirstSeen, LastSeen, SourceIP, SourceUserName, DestinationIP, Hits, Urls

Sigma

title: BTMob Android RAT Lure and C2 Infrastructure Access via Proxy
id: 5b1c7a52-3e0d-4a6f-9a41-6f2d8c1b7e01
status: experimental
description: Detects proxy requests to domains, an IP and an APK filename associated with the BTMob (BTMOB RAT) Android RAT ecosystem (TL-2026-5346).
references:
    - https://flashpoint.io/blog/inside-btmob-how-a-source-code-leak-expanded-access-to-a-mobile-rat/
    - https://blog.quimerax.com/btmob-exposed-inside-a-fraud-as-a-service-platform-with-1400-live-servers/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
    - attack.initial_access
    - attack.t1660
    - attack.defense_evasion
    - attack.t1655.001
    - attack.tool.btmob
logsource:
    category: proxy
detection:
    selection_domain:
        cs-host|endswith:
            - 'btmobrat.net'
            - 'playstoreapps.pro'
            - 'playstoreap.lovable.app'
            - 'rastrear-encomendas2.pages.dev'
            - 'meusdownloads.site'
    selection_ip:
        cs-host: '77.111.101.24'
    selection_apk:
        c-uri|contains: 'lnat-tv-pro.apk'
    condition: 1 of selection_*
falsepositives:
    - Threat researchers or security staff visiting the infrastructure
    - Security awareness exercises that reference the lure domains
level: high

Known false positives:

  • Security researchers or SOC analysts browsing the listed domains for investigation
  • Phishing-awareness simulations that reuse the lure domains or the sample APK name

Tuning notes: Change index/sourcetype to your web proxy feed (pan:url shown). Exclude research/sandbox subnets by src_ip. Domains on shared platforms (lovable.app, pages.dev) are matched only at the exact BTMob-linked hostname; add new hostnames from threat updates. Note the IOC context says the C2 IP is not platform-verified, so treat a lone hit as high-priority triage rather than confirmed compromise.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Android APK Sideload Download from Non-Store Host (BTMob Dropper Delivery) · unlock with TL Creds
  • BTMob / SpySolr / CraxsRAT Family Alerts and Android RAT Technique Evidence in Defender · unlock with TL Creds
  • BTMob WebSocket C2 - Persistent Port 8080 /con Sessions from Mobile Clients · unlock with TL Creds
  • BTMob Ecosystem Domain Resolution (Lure, Storefront and APK Platform) · unlock with TL Creds
  • Android Alert for SMS, Overlay, Keylogging or Screen-Capture Abuse by Accessibility Service (BTMob Behaviours) · unlock with TL Creds
  • BTMob C2 Host Contact - Confirmed C2 IP, Node.js Decoy Port 3000 and WebSocket Port 8080 · unlock with TL Creds
  • BTMob Android RAT - Sideloaded App with Accessibility Service Enabled and Hidden Launcher Icon · unlock with TL Creds
  • BTMob Android RAT - C2 Panel /yaarsa/ Paths and WebSocket Server Components · unlock with TL Creds

Indicators of compromise for BTMob source code leak

As of 2026-11-05, Threadlinqs Intelligence tracks 21 indicators of compromise for TL-2026-5346.

Sample indicators (3 of 21)

  • IP address: 77.111.101[.]24
  • Domain: btmobrat[.]net
  • Domain: playstoreapps[.]pro

Defanged, TLP:CLEAR. Full set of 21 indicators: unlock with TL Creds.

21 indicators of compromise · unlock with TL Creds. Compare plans

How BTMob source code leak works

BTMob (BTMOB RAT) is a malware-as-a-service Android remote access trojan first released in late 2024 and publicly analysed from February 2025. It descends from the SpySolr family and shares lineage with CraxsRAT and CypherRAT, which are attributed to the Syria-based developer EVLF; the operator control panel displays 'BTMOB BY EVLF'. Flashpoint describes a toolkit with components in VB.NET, Java, Node.js, PHP, MySQL, HTML, CSS and JavaScript.

Flashpoint reports that in February 2026 BTMob source code leaked on underground forums including Breach Forums, weakening the original developers' control over distribution and letting other actors obtain, modify and resell it. The resulting ecosystem is fragmented: competing 'legitimate' and modified builds, disputes over authenticity, and allegations that some packages embed malicious code that compromises other criminals. Named actors in Flashpoint's reporting include H7TEEN Anon (developer, Telegram promotion, demo video 2026-03-15), S1mp1y Ducky and ME8TE3N (credited on v4.0), DaarkShop/GhostKernel (primary seller via Crax Shop, distributing payload-creation tutorials), V0id.Ade1r/PriceAde1r/Sparticus (reverse engineer and reseller), Owl (claimed BTMob 4.0 development on 2026-03-29) and R H (advertised a free seven-day trial in April 2026). Distribution channels include Telegram channels (Crax Shop, FP CC CHECK, Reverse Engineering Lab Discussion, SH GROUP, Indian Hackers) and Breach Forums.

Technical analysis by third parties (D3Lab, Quimerax, Aviatrix, Flare) of leaked packages describes heavy abuse of the Android Accessibility Service for UI automation, gesture injection, PIN/pattern replay and silent installation of a second-stage payload from a decoy dropper APK; HTML phishing overlays injected through an invisible WebView for banking credential theft; and screen capture via the MediaProjection API. The backend is an HTTP/WebSocket hybrid: a PHP/MySQL panel under /yaarsa/ paths and a Node.js WebSocket server on port 8080 (ws://<host>:8080/con) exchanging JSON with fields idf, sidf, cip and itype 'Slr_client'. Quimerax fingerprinted about 1,400 exposed C2 hosts through a Node.js decoy page on port 3000 (Shodan http.html_hash -983012381). Delivery described by those sources is phishing pages and fake Play Store sites impersonating banks, logistics and streaming services, with a heavy Brazilian focus (Pix targeting, Portuguese lures); this regional targeting and infrastructure detail comes from the third-party reports, not from Flashpoint, which states no C2, hashes or regional targeting.

Pricing cited by third parties fell steadily: subscriptions of $700/month and $3,000 lifetime in early 2025, source code at $20,000 in May 2025, and secondary-market lifetime access of $500-$1,500 and source code of $1,500-$2,000 by 2026. Source-version dating differs between reports (Flashpoint cites v4.0 on 2025-01-25; others place v4 in Dec 2025, v4.1 Feb 2026, v4.5 Apr 2026, and leaked source for v3.6/v3.6.3/v4.5.7/v4.6), so defenders should treat version numbers as indicative. No CVE is involved; severity is an analyst judgment from capability and proliferation. BeaconBeagle could not be queried for the one network IOC (HTTP 502), so no C2 correlation is recorded.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1406 Obfuscated Files or Information; T1628.001 Hide Artifacts: Suppress Application Icon; T1655.001 Masquerading: Match Legitimate Name or Location

Credential Access

T1417.001 Input Capture: Keylogging; T1417.002 Input Capture: GUI Input Capture

Discovery

T1418 Software Discovery

Collection

T1429 Audio Capture; T1430 Location Tracking; T1512 Video Capture; T1513 Screen Capture; T1636.004 Protected User Data: SMS Messages

Command and Control

T1437.001 Application Layer Protocol: Web Protocols

defense-evasion

T1516 Input Injection

Persistence

T1624.001 Event Triggered Execution: Broadcast Receivers

Exfiltration

T1646 Exfiltration Over C2 Channel

Initial Access

T1660 Phishing

Remediation for BTMob source code leak

Immediate actions

  • Block the network IOCs listed for this threat and alert on WebSocket traffic to port 8080 path /con carrying idf/sidf/cip/itype fields
  • Hunt MDM/EMM inventories for sideloaded APKs, apps with Accessibility Service enabled that are not on an allowlist, and apps with a suppressed launcher icon
  • Take compromised devices off corporate access, reset credentials entered on them and revoke active sessions

Workarounds

  • Restrict Accessibility Service and 'install unknown apps' permissions through MDM policy
  • Enable Google Play Protect and keep Android OS patched

Longer-term hardening

  • Enforce install-from-trusted-store-only policy and block unknown-sources installation on managed Android devices
  • Deploy mobile threat defense that detects Accessibility Service abuse, overlay attacks and MediaProjection screen capture
  • Train users to distrust fake app-store pages, WhatsApp/Telegram APK links and streaming or banking app lures

Affected and fixed versions

  • Google — Android
    Vulnerable versions: Android devices that permit sideloaded APKs and grant Accessibility Service access

Timeline of BTMob source code leak

  • locked-ioc-21 first released in late 2024 (month-level precision; Flashpoint and Flare)
  • Flashpoint dates locked-ioc-21 Version 4.0 to 25 January 2025, crediting S1mp1y Ducky and ME8TE3N; other reports date v4 later
  • First public analysis of locked-ioc-21 RAT (Cyble/CRIL, per Quimerax timeline); Anti-Malware.ru coverage followed on 2025-02-13
  • locked-ioc-21 source code and setup tutorials offered for sale at $20,000 (month-level precision; Flare/Quimerax)
  • locked-ioc-21 source code leaked on underground forums including Breach Forums, weakening the developers' control over distribution (month-level precision; Flashpoint)
  • locked-ioc-15 shared a demonstration video of locked-ioc-21 capabilities
  • Reseller Owl claimed locked-ioc-21 4.0 development
  • R H advertised a free seven-day locked-ioc-21 trial; the official operator also warned about impersonators in April 2026
  • Aviatrix published a locked-ioc-21 analysis mapping phishing delivery and Accessibility Service abuse to MITRE Mobile techniques
  • Flare research on the locked-ioc-21 underground business published via BleepingComputer (sponsored content)
  • Flashpoint published 'Inside locked-ioc-21' describing the leak's effect on the ecosystem

Sources cited for BTMob source code leak

Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats