Threat video1:00
ArcticRAT Android RAT via Fake VPN: Detection & IOCs
ArcticRAT blinds Google Play Protect with a null-routed VPN during install. Its 9 detection rules, 22 IOCs and a free Splunk SPL rule cover the chain.
Read the full threat intel for ArcticRAT Android RAT via Fake VPN: Detection & IOCs →
Chapters
- 0:00The hookArcticRAT fakes a VPN, blinding Play Protect.
- 0:04The storyIt started as crypto spyware.
- 0:10Attack pathZimperium reported a fake Google Play page.
- 0:25AttributionNo threat actor is attributed.
- 0:30Indicators of compromise19 indicators to hunt: 10 IPs, 5 MD5 hashes and 2 package names, and more.
- 0:38MITRE ATT&CK techniques25 ATT&CK techniques, from initial access to collection.
- 0:43Remediation6 steps now: Alert on unexpected VPN permission prompts during app installation.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00ArcticRAT fakes a VPN, blinding Play Protect.
0:05It started as crypto spyware.
0:07About mid-July, AI features appeared.
0:11Zimperium reported a fake Google Play page.
0:14A fake Amazon app appears.
0:16Null-routed VPN blinds Play Protect.
0:19It profiles the phone, reads SMS.
0:21Grok triages stolen data.
0:26No threat actor is attributed. Confidence: low.
0:3019 indicators to hunt: 10 IPs, 5 MD5 hashes and 2 package names, and more.
0:3825 ATT&CK techniques, from initial access to collection.
0:436 steps now: Alert on unexpected VPN permission prompts during app installation.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.