ArcticRAT: AI-Powered Android RAT Evolved from Targeted Crypto-Stealer

Key facts

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5885 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ArcticRAT C2 Server Contact - Zimperium IOC IP Match

Detects any allowed or denied session from an internal host to one of the 19 ArcticRAT C2 IP addresses published in Zimperium's c2.csv (e.g. 91.92.34.13, 167.148.195.29, 45.192.208.10, 85.11.161.20). The family uses raw TCP on 9999 (DEVINFO), 8888, 5000, 5055 and 5058, but this rule matches the IPs on any port. Roughly two-thirds of the infrastructure is in Hong Kong and about 20% in Germany (T1509 Non-Standard Port, T1646 Exfiltration Over C2 Channel).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1509, T1646
• Data sources: palo_alto_firewall_traffic, index=network sourcetype=pan:traffic, CommonSecurityLog (Palo Alto CEF)
• Severity: critical
• Confidence: high

Splunk SPL

index=network sourcetype=pan:traffic earliest=-24h dest_ip IN (91.92.34.13, 167.148.195.29, 192.238.202.57, 192.238.254.27, 192.238.176.41, 45.192.208.10, 45.192.208.182, 45.192.209.220, 45.192.210.66, 85.11.161.20, 85.11.161.30, 85.11.161.34, 85.11.161.55, 85.11.161.76, 93.152.205.71, 93.152.223.55, 108.187.44.146, 212.81.47.172, 2.27.160.3) | stats count AS sessions values(dest_port) AS ports values(action) AS actions sum(bytes_out) AS bytes_out sum(bytes_in) AS bytes_in min(_time) AS first_seen max(_time) AS last_seen BY src_ip dest_ip | convert ctime(first_seen) ctime(last_seen) | sort - sessions

Microsoft KQL

let ArcticRATC2 = dynamic(['91.92.34.13','167.148.195.29','192.238.202.57','192.238.254.27','192.238.176.41','45.192.208.10','45.192.208.182','45.192.209.220','45.192.210.66','85.11.161.20','85.11.161.30','85.11.161.34','85.11.161.55','85.11.161.76','93.152.205.71','93.152.223.55','108.187.44.146','212.81.47.172','2.27.160.3']); CommonSecurityLog | where TimeGenerated > ago(24h) | where DestinationIP in (ArcticRATC2) | summarize Sessions=count(), Ports=make_set(DestinationPort), Actions=make_set(DeviceAction), BytesSent=sum(SentBytes), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP, DestinationIP

Sigma

title: ArcticRAT C2 Server Contact - Zimperium IOC IPs
id: 3e8a4f10-9b27-4c55-8d6a-1f0e7b3a2003
status: experimental
description: Detects network connections to ArcticRAT C2 IP addresses published by Zimperium zLabs (2026-11-ArticRAT c2.csv). Private-range entries from the source file were excluded.
references:
    - https://github.com/Zimperium/IOC/blob/master/2026-11-ArticRAT/c2.csv
    - https://zimperium.com/blog/arcticrat-ai-powered-android-rat
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.command_and_control
    - attack.t1509
    - attack.exfiltration
    - attack.t1646
logsource:
    category: firewall
detection:
    selection:
        dst_ip:
            - '91.92.34.13'
            - '167.148.195.29'
            - '192.238.202.57'
            - '192.238.254.27'
            - '192.238.176.41'
            - '45.192.208.10'
            - '45.192.208.182'
            - '45.192.209.220'
            - '45.192.210.66'
            - '85.11.161.20'
            - '85.11.161.30'
            - '85.11.161.34'
            - '85.11.161.55'
            - '85.11.161.76'
            - '93.152.205.71'
            - '93.152.223.55'
            - '108.187.44.146'
            - '212.81.47.172'
            - '2.27.160.3'
    condition: selection
falsepositives:
    - Reassigned or recycled hosting IPs that later serve unrelated tenants
    - Security researchers or sandboxes probing the listed addresses
level: high

Known false positives:

• Hosting IPs that were reassigned to unrelated tenants after the Zimperium report
• Threat-intel sandboxes or researchers connecting to the listed addresses

Tuning notes: IOC age matters: review hits against current passive DNS/WHOIS before containment. Move the IP list into a lookup (e.g. arcticrat_c2.csv) and refresh from the Zimperium IOC repo. The source cites 21 C2 IPs in one place and 17 in another, so the list may be incomplete. Enrich with source device identity from MDM to find the affected handset.

• 🔒 ArcticRAT Distribution - DNS Lookup of Community-Observed Malvertising Domains · unlock with TL Creds
• 🔒 ArcticRAT LLM Triage - Android Client Calling xAI Chat Completions API · unlock with TL Creds
• 🔒 ArcticRAT Beaconing - Periodic Raw TCP Sessions to External Port 9999 · unlock with TL Creds
• 🔒 ArcticRAT Fake Google Play Landing Page - Play-Lookalike Host Visited from Android · unlock with TL Creds
• 🔒 ArcticRAT Wireless ADB Pairing - mDNS Lookup for _adb-tls-pairing._tcp · unlock with TL Creds
• 🔒 ArcticRAT Raw TCP C2 - Unknown-App Sessions on ArcticRAT Ports · unlock with TL Creds
• 🔒 ArcticRAT Dropper Delivery - Android Client Downloading APK from AWS S3 · unlock with TL Creds
• 🔒 ArcticRAT HVNC / Screen / Microphone Streaming Ports to Same External Host · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 29 indicators of compromise for TL-2026-5885.

Sample indicators (3 of 29)

• IP address: 91.92.34[.]13
• Domain: api[.]x[.]ai
• File hash: 07a7054eb4d40d7f98f771404b608f4d

Defanged, TLP:CLEAR. Full set of 29 indicators: unlock with TL Creds.

Technical analysis

ArcticRAT (named by Zimperium after package names such as net.iceflow.arcticlink and net.frostlink.iceforge) is an Android remote access trojan that started as a stealer aimed at 11 crypto apps and has since broadened its targeting. Zimperium zLabs analyzed 78 samples (42 droppers and 36 unique payloads), versions v6.3 through v6.5.2, and documents 129 C2 commands. The executive summary cites 21 C2 IPs while the technical section cites 17, so the source is inconsistent; roughly two-thirds of the C2 infrastructure is in Hong Kong and about 20% in Germany. No threat actor attribution is stated in the source.

Distribution uses malvertising, smishing and third-party forums, leading to a landing page that impersonates Google Play. Lures impersonate Amazon, generic file managers, TikTok and crypto apps, and some payloads are served directly from AWS buckets (bucket names are not published). The dropper starts a VpnService (session name VlockPJO) that routes 0.0.0.0/0 and ::/0 (addresses 10.0.0.2/24 and fd00:1:1:1::1/64) to null-route the device's traffic, shows a fake install screen in a WebView styled as an Amazon app, decrypts the payload from its assets folder, installs it with the session installer, and then drops the VPN. Persistence relies on boot-completed receivers (including Huawei, Vivo and Oppo-specific intents), BroadcastReceivers for boot, incoming SMS and SCREEN_OFF to re-establish C2, and foreground services with transparent or invisible notifications.

The payload communicates over raw TCP sockets on non-standard ports: 9999 (main, DEVINFO reporting), 8888 (HVNC), 5000 (microphone streaming), 5055 (screen cast) and 5058 (accessibility remote control). A configuration block holds the C2 IP, ports and victim language for localized attacks. It abuses Android Accessibility Services for screen scraping, auto-granting permissions, HVNC gestures, text injection, foreground-app monitoring and blocking uninstall by forcing BACK. HVNC uses MediaProjection and VirtualDisplay, sending JPEG frames. Further capabilities include keylogging to per-day JSON files, screenshots, SMS, call log and contact theft, location, notification access, SMS sending via SmsManager, call/USSD control, a lock-screen credential phishing overlay (PATTERN/PIN/PASSWORD) verified through locksettings, a black-screen overlay that sets brightness to zero, self-uninstall and package removal commands, and a fake ransomware screen that performs no real encryption. On Android 11+ it abuses wireless ADB (mDNS discovery of _adb-tls-pairing._tcp via NsdManager, TLS pairing with an operator-supplied 6-digit code, shell commands such as dumpsys lock_settings and locksettings verify/clear/set-*) to read, clear or set the lock screen PIN, password or pattern.

Since mid-July 2026 samples integrate an LLM: the malware sends two hardcoded prompts to api.x.ai/v1/chat/completions using grok-4.20-0309-non-reasoning, one to identify banking, crypto and trading apps among installed packages, and one to extract OTPs, balance changes and transfer notices from SMS and project the victim's finances as JSON. The xAI_API command sets the API key and prompts and Get_AI_ANA_Data exfiltrates the cached output, stored under /storage/emulated/0/config/AI_DATA/. Other staging paths are /storage/emulated/0/config/System/ (keystrokes), Click_data/, screenshot/ and phis_info/phish_logs.txt. IOCs are not inline in the article; indicators were taken from the Zimperium IOC GitHub repository (2026-11-ArticRAT: c2.csv, droppers.csv, payloads.csv, Commands.md). Private-range addresses in c2.csv (10.x) were excluded.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1407 Download New Code at Runtime; T1628 Hide Artifacts; T1630.001 Indicator Removal on Host: Uninstall Malicious Application; T1630.002 Indicator Removal on Host: File Deletion; T1655.001 Masquerading: Match Legitimate Name or Location

Credential Access

T1417.001 Input Capture: Keylogging; T1417.002 Input Capture: GUI Input Capture

Discovery

T1418 Software Discovery; T1422 System Network Configuration Discovery; T1426 System Information Discovery

Collection

T1429 Audio Capture; T1430 Location Tracking; T1513 Screen Capture; T1517 Access Notifications; T1636.002 Protected User Data: Call Log; T1636.003 Protected User Data: Contact List; T1636.004 Protected User Data: SMS Messages

collection

T1453 Abuse Accessibility Features

Command and Control

T1509 Non-Standard Port

defense-evasion

T1516 Input Injection

Persistence

T1541 Foreground Persistence; T1624.001 Event Triggered Execution: Broadcast Receivers

Impact

T1616 Call Control

Exfiltration

T1646 Exfiltration Over C2 Channel

Initial Access

T1660 Phishing

Remediation

Immediate actions

• Block the ArcticRAT C2 IP addresses and TCP ports 9999, 8888, 5000, 5055 and 5058 at the network perimeter and mobile gateways
• Remove or quarantine devices with the identified package names and re-image if Accessibility Services were enabled for unknown apps
• Rotate banking, crypto-exchange and email credentials and re-enroll MFA for users of infected devices
• Reset device lock screen credentials on suspected devices, since the malware can clear or set PIN/pattern/password via wireless ADB

Workarounds

• Disable installation from unknown sources
• Restrict Accessibility Service grants on managed devices and enable Google Play Protect
• Disable Wireless debugging on managed Android 11+ devices

Longer-term hardening

• Deploy mobile threat defense (MTD) that detects sideloaded apps, Accessibility Service abuse and VpnService null-routing
• Train users to install apps only from the official Google Play Store and to distrust Play-lookalike pages delivered by ads or SMS

Affected and fixed versions

• Google — Android
  Vulnerable versions: Android devices with sideloaded ArcticRAT dropper/payload; wireless ADB abuse on Android 11+

Timeline

• 2026-07-15 Zimperium identifies ArcticRAT samples from mid-July 2026 (exact day not stated; mid-month used) that integrate xAI API calls (grok-4.20-0309-non-reasoning) for financial-data triage.
• 2026-11-12 ArcticRAT tracked as an active threat distributed via fake Google Play landing pages, malvertising and smishing, with payloads in AWS buckets.
• 2026-11-12 Report profiles C2 infrastructure: raw TCP on ports 9999/8888/5000/5055/5058, roughly two-thirds of IPs in Hong Kong and about 20% in Germany; article cites both 21 and 17 C2 IPs.
• 2026-11-12 Report documents the dropper chain: Play-lookalike landing page, VpnService null-route (VlockPJO), fake WebView install screen, decrypted asset payload installed via session installer.
• 2026-11-12 Zimperium publishes ArcticRAT IOCs (C2 IPs, dropper and payload hashes, command list) in its GitHub IOC repository under 2026-11-ArticRAT.
• 2026-11-12 Zimperium zLabs publishes 'Uncovering ArcticRAT: The Evolution from Targeted Crypto-Stealer to AI-Powered Android RAT'.
• 2026-11-12 Zimperium zLabs reports analysis of 78 samples (42 droppers, 36 payloads), versions v6.3 through v6.5.2, with 129 C2 commands documented.

Sources cited

• Uncovering ArcticRAT: The Evolution from Targeted Crypto-Stealer to AI-Powered Android RAT (Zimperium zLabs) zimperium.com · Vendor report · 2026-11-12
• MITRE ATT&CK Mobile Matrix MITRE · Research · 2026-11-12
• Zimperium IOC repository - 2026-11-ArticRAT GitHub · Code repository · 2026-11-12
• ArcticRAT C2 command list (Commands.md) GitHub · Code repository · 2026-11-12
• ArcticRAT C2 IP list (c2.csv) GitHub · Code repository · 2026-11-12
• ArcticRAT payload hashes (payloads.csv) GitHub · Code repository · 2026-11-12
• ArcticRAT dropper hashes (droppers.csv) GitHub · Code repository · 2026-11-12

More in malware

• ClickFix in the Wild: New RATs (CrashHandler, CrocoRat), Stripe-Based C2, and Signed Google Tool Abused to Weaken Microsoft Defender
• Predator, Pegasus and Graphite Mercenary Spyware: Government-Linked Abuse Against Journalists, Activists and Politicians in Europe with Little Accountability
• ArcticRAT Android RAT Uses Fake VPN Tunnel to Evade Google Play Protect and xAI Grok for Financial Triage
• Hackers Hijack Microsoft SQL Servers Using T-SQL Commands to Install Gh0st RAT and Crypto Miners
• AccuraSoftHire Fake Interview Campaign: PolinRider Loader Delivered via Malicious Tailwind npm Look-alikes and Fake Camera Driver to Developer Machines

Previous and next in malware

• T-SQL Abused to Deliver XMRig Miner and Gh0st RAT on Compromised MS SQL Servers Previous report
• TypoPrompting: 186 Fake AI-Brand Typosquat Domains Deliver ClickFix Lures, Net Guard Browser Hijacker, and Quick Search Extension Next report