Loading story…
Check Point Research reported that the Rogue mobile remote-access trojan resurfaced through a dark-web operation tied to the actors Triangulum and HeXaGoN Dev, who developed, marketed, and sold Android malware. Investigators said Rogue was not a wholly new family but an evolution of earlier projects, blending elements from HeXaGoN’s DarkShades/Cosmos RAT lineage with leaked Hawkshaw code, while continuing to be promoted and sold even after the Rogue package itself was leaked.
The malware was built for broad surveillance and device control on Android, abusing permissions and accessibility features to maintain persistence and harvest victim data. Researchers said Rogue also relied on Google Firebase services for command-and-control and data exfiltration, highlighting how legitimate cloud infrastructure was used to support the campaign’s operations and conceal malicious activity behind a commercial mobile malware business model.
Pull IOCs and campaign context straight into your stack.
11 events from the most recent confirmed update back to the earliest known activity.
In January 2021, Check Point Research published its investigation into Triangulum, HeXaGoN Dev, and the Rogue Android MRAT, describing Rogue as a combination of DarkShades/Cosmos and leaked Hawkshaw code.
Check Point Research noted that the Rogue Android malware package had been leaked by April 2020, though sales activity continued afterward.
In April 2020, Triangulum attempted to sell malware on a Russian darknet forum but failed to gain trust because he would not provide a demo video.
Three days after DarkShades was first offered for sale in August 2019, the project was sold to Triangulum, who then opened a new sales thread for it.
In August 2019, HeXaGoN Dev began selling the DarkShades Android malware project, a code base later linked to Rogue.
On April 6, 2019, Triangulum resurfaced after about a year and a half of inactivity and offered another malware product for sale.
On October 20, 2017, Triangulum posted his first malware offering for sale on darknet forums.
On June 10, 2017, Triangulum demonstrated an Android mobile RAT that could exfiltrate sensitive data to a command-and-control server and destroy local data, including the operating system.
The Hawkshaw Android malware source code was leaked in 2017 and remained publicly available online, later becoming one of the code bases incorporated into Rogue.
Check Point Research reported that the actor Triangulum appears to have started operating on darknet forums in early 2017, laying the groundwork for later Android malware sales.
Within roughly half a year of his April 2019 return, Triangulum had advertised four different malware products on darknet forums, showing a rapid expansion of his offerings.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 57 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple Android malware operations have been documented using remote access trojans to seize control of victims’ phones, steal sensitive data, and support financial fraud. Reporting on **CraxsRAT** describes a malware family built to give operators broad device access, while separate research identified **Klopatra**, an Android RAT disguised as the IPTV and VPN app **“Modpro IP TV + VPN,”** infecting more than 3,000 devices in Europe and enabling hidden remote control through a black-screen VNC feature. Klopatra also supports banking overlay attacks, gesture simulation, clipboard theft, keystroke capture, and screen monitoring, allowing attackers to conduct credential theft and fraudulent transactions while the device appears inactive. A third investigation found attackers targeting high-value individuals in South Asia with Android malware built on **SpyNote**, delivered through WhatsApp under multiple app names and tied to shared command-and-control infrastructure. That malware was designed to hide itself after installation and collect location data, contacts, SMS messages, call records, device information, files, screenshots, and keystrokes, particularly when accessibility permissions were granted. Across the reported cases, the malware showed strong evasion and persistence features, including obfuscation, anti-debugging, emulator detection, and attempts to disable security tools, underscoring how modern Android RATs are being adapted for espionage, credential theft, and banking abuse.
Jun 29, 2026
Two newly reported Android **Remote Access Trojans (RATs)**—**SURXRAT** and **Oblivion**—highlight a continued shift toward *commercialized, subscription-based mobile malware* that enables non-expert criminals to gain full control of victim devices and exfiltrate data. Both threats are positioned as scalable offerings (i.e., **Malware-as-a-Service**) with structured sales models and distribution support, lowering the barrier to entry for surveillance, credential theft, and account takeover. The reported infection chains rely heavily on **social engineering** to trick users into installing or activating malicious components, then escalating control by abusing **Android Accessibility Services** to bypass normal interaction and security boundaries. SURXRAT is described as modular and stealth-focused, distributed primarily via **Telegram** channels with tiered licensing/reseller options, and capable of broad data access (e.g., SMS, contacts, location, storage) once high-risk permissions are granted. Oblivion is marketed at roughly **$300/month** (with longer-term pricing tiers) and is delivered via **fake Google Play update** prompts; researchers reported capabilities including SMS theft for banking codes, keylogging, remote unlocking after reboot, and covert live screen viewing while a decoy “system updating” animation distracts the victim, with infrastructure reportedly able to manage **1,000+** concurrent victims (including via Tor).
Jun 29, 2026
Researchers reported two **Telegram-marketed malware-as-a-service (MaaS)** offerings focused on mobile device compromise and surveillance. *ZeroDayRAT* is advertised as a subscription spyware platform claiming full monitoring of **Android and iOS** devices, with infections driven by **smishing** and other social-engineering lures that push victims to malicious links disguised as legitimate apps/updates; delivery chains reportedly use multi-stage redirects, URL shorteners, and in some cases trusted hosting such as *GitHub Pages* to evade reputation-based filtering. Once installed, the operator-facing web panel is advertised to provide extensive monitoring, including device profiling, app-usage timelines, GPS tracking, and remote activation of camera/microphone, plus screen recording and keystroke logging—capabilities consistent with credential theft and broad user surveillance. Separately, Cyble detailed ongoing development of *SURXRAT* (marketed as **SURXRAT V5**) as an Android RAT sold through a structured reseller/partner licensing model that enables affiliates to generate customized builds while the operator retains centralized control. The malware is described as a full-featured surveillance and device-control toolkit that abuses **Android Accessibility** permissions for persistent control and uses **Firebase-backed C2**; code similarities indicate lineage from **ArsinkRAT**. Recent samples were observed conditionally downloading a **large LLM module from Hugging Face**, which researchers assess as experimentation that could enable AI-assisted functionality, deliberate device performance impact, or new monetization approaches alongside established behaviors such as data exfiltration, remote command execution, and ransomware-style device locking.
Jun 29, 2026