APT / THREAT GROUP

AndroRAT

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Androrat is a remote administration tool developed in Java Android for the client side and in Java/Swing for the Server. The name Androrat is a mix of Android and RAT (Remote Access Tool). It has been developed in a team of 4 for a university project. The goal of the application is to give the control of the android system remotely and retrieve informations from it.

Threat Analysis

AndroRAT is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html

→https://blog.trendmicro.com/trendlabs-security-intelligence/the-urpage-connection-to-bahamut-confucius-and-patchwork/

→https://cocomelonc.github.io/book/2025/05/19/aiya-mmd-book.html

→https://github.com/DesignativeDave/androrat

→https://hotforsecurity.bitdefender.com/blog/possibly-italy-born-android-rat-reported-in-china-find-bitdefender-researchers-16264.html

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

apk.androratAndroRAT

External Intelligence

Malpedia: apk.androrat

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search AndroRAT