From BlackCat to Panda Workshop: Inside the Evolving C2 Panel Behind RATHat

The report

Cleafy’s TIR team analyzed the operator infrastructure behind RATHat, an Android banking trojan that abuses Accessibility Services to enable wireless debugging on the victim’s phone, obtain a shell, and deploy a hidden native service outside the app. The investigation recovered three generations of the Chinese-language control panel, consistent with a Malware-as-a-Service model.

Read the full analysis: From BlackCat to Panda Workshop: Inside the Evolving C2 Panel Behind RATHat (cleafy.com).

Indicators

Malware C

• admin[.]xiongmaocs[.]pics
• admin[.]chunhuating[.]best

Defanged so they cannot be clicked by mistake: replace [.] with a dot. Shared hosting and CDN addresses named in the report are left out on purpose, so blocking these does not break legitimate sites.

How this is tracked

EncryptLayer intelligence, A.R.P. Syndicate’s open threat feed, reviews each indicator against the published report before adding it (#3). This page is generated from that record and the report’s own title and summary; nothing is rewritten.