Zimperium recently uncovered a novel Android malware linked to threat actors possibly operating in China that they dubbed “RatHat.” The threat incorporated novel techniques for persistence and leveraged generative AI for operational control.

Spread primarily via targeted smishing and malvertising campaigns leading to deceptive third-party download portals, RatHat used an automated multistage infection pipeline. Once deployed, it paired Accessibility abuse with autonomous local ADB self-pairing to break out of the standard Android application sandbox, staging independent native daemons that executed with shell-level privileges.

The researchers identified 20 network IoCs in their report comprising 15 subdomains and five domains. We extracted 14 unique domains not yet on the original list from the subdomains, increasing the number to 19 domains. Then, we queried them on the WhoisXML API MCP Server and discovered that one domain was likely legitimate. That left us with 15 subdomains and 18 domains, totaling 33 network IoCs, for our own investigation that led to these findings:

• 240 distinct client IP addresses that communicated with six of the domain IoCs
• Three domain IoCs that appeared in two typosquatting groups with 5–6 members each
• One domain IoC that was likely registered with malicious intent
• 8,461 email-connected domains, four were confirmed malicious
• Seven IP addresses, all of which were confirmed malicious
• Three IP-connected domains, one was confirmed malicious
• 13 string-connected domains

A sample of the additional artifacts obtained from our analysis is available for download from our website.

RatHat Subdomain IoCs in the Spotlight

We kicked off our analysis by looking more closely at the DNS infrastructure of the 15 subdomain IoCs. Here is a summary of our findings from the results of our WhoisXML API MCP Server query.

RatHat Domain IoCs under the Microscope

Next, we zoomed in on the 18 domain IoCs. We looked at sample network traffic data from the IASC and learned that 240 unique client IP addresses under two distinct ASNs communicated with six of the domain IoCs via 297 DNS queries between 28 July and 1 September 2026.

When queried on Bulk Registration Risk API, we discovered that three domain IoCs appeared in two typosquatting groups with 5–6 members each on 3–4 August 2026.

The IoC xiongmaocs[.]help was bulk-registered with four lookalikes—xiogmaocs[.]mom, xiongmaoys[.]help, xiongmaocs[.]best, and xiongmaoll[.]xyz—on 3 August 2026. Four were administered by NameSilo and registered in the U.S. while one was managed by GMO Internet Group and registered in Japan.

Data from the First Watch Malicious Domains Data Feed also revealed that the domain gpgmk[.]com appeared on the database 441 days before it was tagged as an IoC on 16 September 2026.

We then queried the IoCs on WHOIS API and completed missing data points aided by Domain Info API. We found out that:

• They were created between 18 February 2024 and 19 August 2026.

  

• They were administered by eight registrars.

  

• While three did not have registrant countries on record, the remaining 15 were registered in two countries.

  

Finally, we queried the IoCs on DNS Chronicle API and discovered that 13 recorded 138 historical domain-to-IP resolutions over time. Take a look at more information for five examples below.

New RatHat-Connected Artifacts Found

Our hunt for connected artifacts began with a WHOIS History API query for the domain IoCs. We learned that 12 had 11 unique email addresses in their historical WHOIS records. Of these, nine were public email addresses although one could belong to a domainer. That left us with eight public email addresses for the next step.

We then queried the public email addresses on Reverse WHOIS API, which led to the discovery of 8,461 distinct email-connected domains after those already tagged as IoCs were filtered out.

The results of our Threat Intelligence API query for the email-connected domains showed that four have already been weaponized for various threats. An example is qfdhb[.]com, which has been associated with malware distribution since 9 March 2023.

Next, we determined the 10 most visited email-connected domains aided by Domain Traffic API.

This post only contains a snapshot of the full research. Download the complete findings and a sample of the additional artifacts on our website or contact us to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

Disclaimer: We take a cautionary stance toward threat detection and aim to provide relevant information to help protect against potential dangers. Consequently, it is possible that some entities identified as “threats” or “malicious” may eventually be deemed harmless upon further investigation or changes in context. We strongly recommend conducting supplementary investigations to corroborate the information provided herein.