MalwareUsed by 1 actor

RatMilad

RatMilad is an Android spyware family targeting mobile users in the Middle East, including enterprise device users. It has been distributed through trojanized applications promoted on social media and Telegram, where the malware masquerades as tools offering services such as VPN access, phone-number spoofing, or social-media account verification. Observed loader applications sideload the spyware outside official app stores and rely on victims granting extensive permissions during installation.

Once installed, RatMilad functions as a remote surveillance and data-theft implant. It can receive and execute operator commands, collect detailed device profiling information, enumerate installed applications and their permissions, harvest account information, and gather subscriber and handset identifiers such as IMEI, MAC address, phone number, SIM state, and related device metadata. It is also capable of stealing contacts, SMS messages, call logs, clipboard contents, GPS location data, and files stored on the device, including through directory listing and file-management operations. Additional functionality includes uploading collected data to command-and-control infrastructure, recording audio from the device, and modifying application permissions, including setting new permissions.

RatMilad communicates with its command-and-control infrastructure over HTTP, including use of HTTP POST for data transmission. Its feature set supports espionage, eavesdropping, and potentially extortion through broad access to personal and corporate mobile data. Reporting has assessed that the operators likely leveraged source code associated with the Iranian AppMilad hacker group and combined it with fraudulent Android applications to infect victims.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

AppMilad

RatMilad, a newly discovered Android spyware, has been stealing data from mobile devices in the Middle East.

via socradar blogsocradar.io

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

The malware is spread through links on social media and pretends to be applications for services like VPN and phone number spoofing.

Execution

1 technique

T1059Command and Scripting InterpreterEvidence1

The capabilities of spyware include the ability to receive and execute commands to gather and exfiltrate data and carry out a wide range of malicious operations

Stealth

1 technique

T1036MasqueradingEvidence1

The malware is spread through links on social media and pretends to be applications for services like VPN and phone number spoofing.

Discovery

4 techniques

T1069Permission Groups DiscoveryEvidence1

List of the installed applications, along with their permissions. Set new application permissions.

T1082System Information DiscoveryEvidence2

Phone info – Model, Brand, buildID, android version, manufacturer

T1083File and Directory DiscoveryEvidence3

File list

T1518Software DiscoveryEvidence1

List of the installed applications, along with their permissions.

Collection

2 techniques

T1005Data from Local SystemEvidence3

Read, write, and Delete Files

T1115Clipboard DataEvidence1

Clipboard Data

Command and Control

1 technique

T1071.001Web ProtocolsEvidence1

AbstractEmu can use HTTP to communicate with the C2 server; AhRat can communicate with the C2 using HTTPS requests; BRATA can use both HTTP and WebSockets to communicate with the C2 server; LightSpy has used both HTTPS and Websockets to communicate with the C2.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

The capabilities of spyware include the ability to receive and execute commands to gather and exfiltrate data... File upload to C&C

ACTIVITY FEED

Recent activity

17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

17 SOURCESView more in app

mitre attack websiteNews

Oct 28, 2025

Updates | MITRE ATT&CK®

... RatMilad ... (v1.0) ...

mitre attack mediumNews

Oct 28, 2025

ATT&CK v18: The Detection Overhaul You’ve Been Waiting For | by Amy L. Robertson | MITRE ATT&CK® | Medium

Mobile RAT referenced as collecting account data (account names/types) from compromised devices.

mitre attack websiteNews

Oct 28, 2025

Updates - Updates - October 2025 | MITRE ATT&CK®

RatMilad (v1.0)

the hacker newsNews

Jul 21, 2025

Iran-Linked DCHSpy Android Malware Masquerades as VPN Apps to Spy on Dissidents

Other documented malware strains include AridSpy, BouldSpy, GuardZoo, RatMilad, and SpyNote.

+13 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

RatMilad