# ArcticRAT: AI-Powered Android RAT Evolved from Targeted Crypto-Stealer

> Zimperium zLabs analyzed 78 ArcticRAT samples (42 droppers, 36 payloads) of an Android RAT that began as a crypto-app stealer and now provides hidden VNC, keylogging, SMS/call control, phishing overlays and a fake ransomware lock screen. It calls the xAI API (grok-4.20-0309-non-reasoning) to triage installed apps and SMS for financial data and is distributed through fake Google Play pages with payloads in AWS buckets.

- **Published:** 2026-11-12T19:49:19Z
- **Last reviewed:** 2026-11-12T19:49:19Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5885
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5885.png
- **ID:** TL-2026-5885
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 29 (3 shown free below)

## Description

ArcticRAT (named by Zimperium after package names such as net.iceflow.arcticlink and net.frostlink.iceforge) is an Android remote access trojan that started as a stealer aimed at 11 crypto apps and has since broadened its targeting. Zimperium zLabs analyzed 78 samples (42 droppers and 36 unique payloads), versions v6.3 through v6.5.2, and documents 129 C2 commands. The executive summary cites 21 C2 IPs while the technical section cites 17, so the source is inconsistent; roughly two-thirds of the C2 infrastructure is in Hong Kong and about 20% in Germany. No threat actor attribution is stated in the source.

Distribution uses malvertising, smishing and third-party forums, leading to a landing page that impersonates Google Play. Lures impersonate Amazon, generic file managers, TikTok and crypto apps, and some payloads are served directly from AWS buckets (bucket names are not published). The dropper starts a VpnService (session name VlockPJO) that routes 0.0.0.0/0 and ::/0 (addresses 10.0.0.2/24 and fd00:1:1:1::1/64) to null-route the device's traffic, shows a fake install screen in a WebView styled as an Amazon app, decrypts the payload from its assets folder, installs it with the session installer, and then drops the VPN. Persistence relies on boot-completed receivers (including Huawei, Vivo and Oppo-specific intents), BroadcastReceivers for boot, incoming SMS and SCREEN_OFF to re-establish C2, and foreground services with transparent or invisible notifications.

The payload communicates over raw TCP sockets on non-standard ports: 9999 (main, DEVINFO reporting), 8888 (HVNC), 5000 (microphone streaming), 5055 (screen cast) and 5058 (accessibility remote control). A configuration block holds the C2 IP, ports and victim language for localized attacks. It abuses Android Accessibility Services for screen scraping, auto-granting permissions, HVNC gestures, text injection, foreground-app monitoring and blocking uninstall by forcing BACK. HVNC uses MediaProjection and VirtualDisplay, sending JPEG frames. Further capabilities include keylogging to per-day JSON files, screenshots, SMS, call log and contact theft, location, notification access, SMS sending via SmsManager, call/USSD control, a lock-screen credential phishing overlay (PATTERN/PIN/PASSWORD) verified through locksettings, a black-screen overlay that sets brightness to zero, self-uninstall and package removal commands, and a fake ransomware screen that performs no real encryption. On Android 11+ it abuses wireless ADB (mDNS discovery of _adb-tls-pairing._tcp via NsdManager, TLS pairing with an operator-supplied 6-digit code, shell commands such as dumpsys lock_settings and locksettings verify/clear/set-*) to read, clear or set the lock screen PIN, password or pattern.

Since mid-July 2026 samples integrate an LLM: the malware sends two hardcoded prompts to api.x.ai/v1/chat/completions using grok-4.20-0309-non-reasoning, one to identify banking, crypto and trading apps among installed packages, and one to extract OTPs, balance changes and transfer notices from SMS and project the victim's finances as JSON. The xAI_API command sets the API key and prompts and Get_AI_ANA_Data exfiltrates the cached output, stored under /storage/emulated/0/config/AI_DATA/. Other staging paths are /storage/emulated/0/config/System/ (keystrokes), Click_data/, screenshot/ and phis_info/phish_logs.txt. IOCs are not inline in the article; indicators were taken from the Zimperium IOC GitHub repository (2026-11-ArticRAT: c2.csv, droppers.csv, payloads.csv, Commands.md). Private-range addresses in c2.csv (10.x) were excluded.

## MITRE ATT&CK

- T1660 Phishing
- T1453 Abuse Accessibility Features
- T1624.001 Event Triggered Execution: Broadcast Receivers
- T1541 Foreground Persistence
- T1655.001 Masquerading: Match Legitimate Name or Location
- T1407 Download New Code at Runtime
- T1630.001 Indicator Removal on Host: Uninstall Malicious Application
- T1630.002 Indicator Removal on Host: File Deletion
- T1628 Hide Artifacts
- T1516 Input Injection
- T1417.001 Input Capture: Keylogging
- T1417.002 Input Capture: GUI Input Capture
- T1418 Software Discovery
- T1426 System Information Discovery
- T1422 System Network Configuration Discovery
- T1636.004 Protected User Data: SMS Messages
- T1636.002 Protected User Data: Call Log
- T1636.003 Protected User Data: Contact List
- T1429 Audio Capture
- T1513 Screen Capture
- T1517 Access Notifications
- T1430 Location Tracking
- T1509 Non-Standard Port
- T1646 Exfiltration Over C2 Channel
- T1616 Call Control

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ArcticRAT C2 Server Contact - Zimperium IOC IP Match** (`TL-2026-5885-SPL-003`)

Detects any allowed or denied session from an internal host to one of the 19 ArcticRAT C2 IP addresses published in Zimperium's c2.csv (e.g. 91.92.34.13, 167.148.195.29, 45.192.208.10, 85.11.161.20). The family uses raw TCP on 9999 (DEVINFO), 8888, 5000, 5055 and 5058, but this rule matches the IPs on any port. Roughly two-thirds of the infrastructure is in Hong Kong and about 20% in Germany (T1509 Non-Standard Port, T1646 Exfiltration Over C2 Channel).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1509, T1646
- **Data sources:** palo_alto_firewall_traffic, index=network sourcetype=pan:traffic, CommonSecurityLog (Palo Alto CEF)
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=network sourcetype=pan:traffic earliest=-24h dest_ip IN (91.92.34.13, 167.148.195.29, 192.238.202.57, 192.238.254.27, 192.238.176.41, 45.192.208.10, 45.192.208.182, 45.192.209.220, 45.192.210.66, 85.11.161.20, 85.11.161.30, 85.11.161.34, 85.11.161.55, 85.11.161.76, 93.152.205.71, 93.152.223.55, 108.187.44.146, 212.81.47.172, 2.27.160.3) | stats count AS sessions values(dest_port) AS ports values(action) AS actions sum(bytes_out) AS bytes_out sum(bytes_in) AS bytes_in min(_time) AS first_seen max(_time) AS last_seen BY src_ip dest_ip | convert ctime(first_seen) ctime(last_seen) | sort - sessions
```

### Microsoft KQL

```kql
let ArcticRATC2 = dynamic(['91.92.34.13','167.148.195.29','192.238.202.57','192.238.254.27','192.238.176.41','45.192.208.10','45.192.208.182','45.192.209.220','45.192.210.66','85.11.161.20','85.11.161.30','85.11.161.34','85.11.161.55','85.11.161.76','93.152.205.71','93.152.223.55','108.187.44.146','212.81.47.172','2.27.160.3']); CommonSecurityLog | where TimeGenerated > ago(24h) | where DestinationIP in (ArcticRATC2) | summarize Sessions=count(), Ports=make_set(DestinationPort), Actions=make_set(DeviceAction), BytesSent=sum(SentBytes), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP, DestinationIP
```

### Sigma

```yaml
title: ArcticRAT C2 Server Contact - Zimperium IOC IPs
id: 3e8a4f10-9b27-4c55-8d6a-1f0e7b3a2003
status: experimental
description: Detects network connections to ArcticRAT C2 IP addresses published by Zimperium zLabs (2026-11-ArticRAT c2.csv). Private-range entries from the source file were excluded.
references:
    - https://github.com/Zimperium/IOC/blob/master/2026-11-ArticRAT/c2.csv
    - https://zimperium.com/blog/arcticrat-ai-powered-android-rat
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.command_and_control
    - attack.t1509
    - attack.exfiltration
    - attack.t1646
logsource:
    category: firewall
detection:
    selection:
        dst_ip:
            - '91.92.34.13'
            - '167.148.195.29'
            - '192.238.202.57'
            - '192.238.254.27'
            - '192.238.176.41'
            - '45.192.208.10'
            - '45.192.208.182'
            - '45.192.209.220'
            - '45.192.210.66'
            - '85.11.161.20'
            - '85.11.161.30'
            - '85.11.161.34'
            - '85.11.161.55'
            - '85.11.161.76'
            - '93.152.205.71'
            - '93.152.223.55'
            - '108.187.44.146'
            - '212.81.47.172'
            - '2.27.160.3'
    condition: selection
falsepositives:
    - Reassigned or recycled hosting IPs that later serve unrelated tenants
    - Security researchers or sandboxes probing the listed addresses
level: high
```

**Known false positives:**

- Hosting IPs that were reassigned to unrelated tenants after the Zimperium report
- Threat-intel sandboxes or researchers connecting to the listed addresses

**Tuning notes:** IOC age matters: review hits against current passive DNS/WHOIS before containment. Move the IP list into a lookup (e.g. arcticrat_c2.csv) and refresh from the Zimperium IOC repo. The source cites 21 C2 IPs in one place and 17 in another, so the list may be incomplete. Enrich with source device identity from MDM to find the affected handset.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ArcticRAT Distribution - DNS Lookup of Community-Observed Malvertising Domains (locked: unlock with TL Creds)
- ArcticRAT LLM Triage - Android Client Calling xAI Chat Completions API (locked: unlock with TL Creds)
- ArcticRAT Beaconing - Periodic Raw TCP Sessions to External Port 9999 (locked: unlock with TL Creds)
- ArcticRAT Fake Google Play Landing Page - Play-Lookalike Host Visited from Android (locked: unlock with TL Creds)
- ArcticRAT Wireless ADB Pairing - mDNS Lookup for _adb-tls-pairing._tcp (locked: unlock with TL Creds)
- ArcticRAT Raw TCP C2 - Unknown-App Sessions on ArcticRAT Ports (locked: unlock with TL Creds)
- ArcticRAT Dropper Delivery - Android Client Downloading APK from AWS S3 (locked: unlock with TL Creds)
- ArcticRAT HVNC / Screen / Microphone Streaming Ports to Same External Host (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 29)

Defanged, TLP:CLEAR.

- IP address: `91.92.34[.]13`
- Domain: `api[.]x[.]ai`
- File hash: `07a7054eb4d40d7f98f771404b608f4d`

Full set of 29 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Uncovering ArcticRAT: The Evolution from Targeted Crypto-Stealer to AI-Powered Android RAT (Zimperium zLabs)](https://zimperium.com/blog/arcticrat-ai-powered-android-rat)
- [Zimperium IOC repository - 2026-11-ArticRAT](https://github.com/Zimperium/IOC/tree/master/2026-11-ArticRAT)
- [ArcticRAT C2 command list (Commands.md)](https://github.com/Zimperium/IOC/tree/master/2026-11-ArticRAT/Commands.md)
- [ArcticRAT C2 IP list (c2.csv)](https://github.com/Zimperium/IOC/blob/master/2026-11-ArticRAT/c2.csv)
- [ArcticRAT payload hashes (payloads.csv)](https://github.com/Zimperium/IOC/blob/master/2026-11-ArticRAT/payloads.csv)
- [ArcticRAT dropper hashes (droppers.csv)](https://github.com/Zimperium/IOC/blob/master/2026-11-ArticRAT/droppers.csv)
- [MITRE ATT&CK Mobile Matrix](https://attack.mitre.org/matrices/mobile/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5885