MITRE ATT&CKsoftware (malware)
S1241 RatMilad
- Domain
- mobile
- Platforms
- Android
- Version
- 1.0
- Created
- 2025-09-18
Description
RatMilad is an Android remote access tool (RAT) with spyware functionality that has been used to target enterprise mobile devices in the Middle East since at least 2021. Variants of RatMilad have been disguised as VPN applications and a fake app named NumRent. Upon installation, RatMilad employs multiple Collection techniques to collect sensitive information before uploading the collected data to its command and control (C2) server.
Related
Uses · MITRE ATT&CK (18)
- T1636.005 Accounts sub-technique
- T1662 Data Destruction technique
- T1660 Phishing technique
- T1437.001 Web Protocols sub-technique
- T1636.002 Call Log sub-technique
- T1636.003 Contact List sub-technique
- T1636.004 SMS Messages sub-technique
- T1646 Exfiltration Over C2 Channel technique
- T1533 Data from Local System technique
- T1512 Video Capture technique
- T1407 Download New Code at Runtime technique
- T1414 Clipboard Data technique
- T1418 Software Discovery technique
- T1420 File and Directory Discovery technique
- T1422 System Network Configuration Discovery technique
- T1426 System Information Discovery technique
- T1429 Audio Capture technique
- T1430 Location Tracking technique
References
- https://zimperium.com/blog/we-smell-a-ratmilad-mobile-spyware ZimperiumGupta_RatMilad_Oct2022