APT / THREAT GROUP
RatMilad
2
aliases
Last seen:Mar 17, 2026
Intelligence Profile
RatMilad, a newly discovered Android spyware, has been stealing data from mobile devices in the Middle East.
The malware is spread through links on social media and pretends to be applications for services like VPN and phone number spoofing. Unwary users download these trojan applications and grant access to malware.
Threat Analysis
RatMilad is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.
External References
Quick Facts
TypeAPT / Threat Group
Aliases2
Also Known As
apk.ratmiladRatMilad
External Intelligence
Malpedia: apk.ratmiladResearch Links
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.