The wolf is back...
Summary: Cisco Talos identified a new Android RAT it named WolfRAT, built on the leaked DenDroid malware source code and linked through command-and-control infrastructure and string references to the closed interception firm Wolf Research. The campaigns target Android devices in Thailand, with some C2 servers located there, Thai JavaScript comments on the panels, and domain names referencing Thai food; Talos found at least four major releases of the RAT, active from mid-June to the time of writing.
What you should know: The operators behind Wolf Research are still active despite the organization's closure and the creation of a successor firm, LokD, and the malware's commands - takephoto, takevideo, recordaudio, getsentsms, uploadpictures - are built for espionage, including screen capture of WhatsApp, Line and Facebook Messenger chats.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026