RatHat's Evolving C2 Panel Points to Malware-as-a-Service Model
Cleafy details RatHat Android banking trojan's C2 panel evolving into a Gemini-powered malware-as-a-service platform that ranks victims by estimated bank balance.
Cleafy research published September 28 shows the RatHat implant changed little from late 2025 through September 2026, while its C2 panel went through three generations in six months and rebranded from BlackCat to Panda Workshop. Nearly 100 deployments since April 2026 support a malware-as-a-service model, with campaigns across Europe, Latin America, and Southeast Asia; almost half of observed IPs sat on one Singapore-based network. The latest panel uses Google Gemini to analyze stolen SMS messages and estimate victims' bank balances, sorting devices into high-value and mid-value groups. Operators can also deploy a native Go service via wireless debugging for shell-level control outside Android's permission model, persisting until reboot.
- RatHat C2 rebranded BlackCat to Panda Workshop, three panel generations in six months
- Nearly 100 deployments since April 2026 across Europe, Latin America, Southeast Asia
- Gemini ranks infected devices by estimated bank balance from collected SMS
- One-click Go service via wireless debugging gains shell outside Android permissions
- Panels build, sign, and regenerate samples to evade hash-based detection
Full article405 words · extracted from infosecurity-magazine.com · click to collapse
The infrastructure behind the RatHat Android banking trojan has changed more than the malware itself, with successive command-and-control (C2) panels able to build malware, manage infected devices and use AI to rank potential victims.
In research published September 28, Cleafy said the implant had changed little from late 2025 through September 2026, while its C2 panel went through three generations in six months and rebranded from BlackCat to Panda Workshop.
Nearly 100 separate deployments since April 2026 have been observed, consistent with a malware-as-a-service (MaaS) model.
RatHat C2 Becomes a Malware Factory
Cleafy said the panels could build, sign and publish new Android samples directly from the operator console. They could also regenerate samples on a schedule, producing fresh files to evade hash-based detection while the underlying implant stayed largely unchanged.
Panda Workshop V5 added two-factor authentication (2FA) for operators, and V6 added a phishing download-page builder. Cleafy said account limits and role-based access within the panels were consistent with a commercial model in which customers operated their own RatHat instances.
Campaigns ran in parallel across Europe, Latin America and Southeast Asia, and nearly half of the observed IP addresses sat on a single Singapore-based network.
Cleafy also found that operators could use RatHat's wireless debugging access to deploy a native Go service with a single click from the panel, gaining shell-level control outside the Android application's permission model. The service could remain active after the malicious application was removed, until the next reboot.
AI Helps Rank RatHat Victims
Cleafy found the latest panel used Gemini to analyze SMS messages already collected from infected devices and estimate victims' bank balances. The resulting scores sorted devices into high-value and mid-value groups, helping operators identify targets without reviewing every infected phone by hand.
Cleafy stressed that the AI tool was used for victim prioritization, not to carry out fraud.
The malware used Gemini separately: when its static automation failed on unfamiliar Android interfaces, the implant sent details of the screen to a large language model (LLM) and asked where to tap.
Cleafy said earlier panels supported multiple AI providers, but Panda Workshop V6 consolidated the configuration around Google's Gemini.
The company warned that the device-side technique could revive automated transfer systems (ATS), long limited by the cost of scripting each banking app, although nothing in the samples performed a fraudulent transfer.