Loading threat actor…
SURXRAT is an actively developed Android remote access trojan marketed as a malware-as-a-service offering under the SURXRAT V5 branding. It is distributed through a Telegram-based reseller and partner ecosystem that enables affiliates to generate and deploy customized builds while the operator retains centralized infrastructure and operational control. Available reporting indicates development likely began in early 2025, with substantial sample volume observed by 2026. SURXRAT is designed for broad surveillance, device takeover, and monetization on Android devices. It solicits high-risk permissions and abuses Android Accessibility Services to strengthen persistence and expand attacker control. Reported capabilities include collection and exfiltration of contacts, SMS messages, call logs, device and network metadata, browser-related activity, notifications, clipboard contents, Wi-Fi history, and cellular intelligence. It also supports extensive remote actions such as taking photos, recording audio, sending SMS, placing calls, opening content, manipulating device settings and user interface elements, transferring or deleting files, locking or unlocking the device, and wiping storage. The malware communicates with backend infrastructure through Firebase Realtime Database, allowing near-real-time command execution while blending with legitimate cloud traffic. A notable extortion-oriented feature is a ransomware-style screen locker that can deny device access, display attacker-controlled payment demands, and report failed unlock attempts back to the operator. Additional functionality includes mechanisms intended to manipulate device or network performance. Code references and functional overlap indicate SURXRAT likely evolved from the ArsinkRAT malware family. A newer observed behavior is conditional downloading of a very large language-model package when specified applications are active or when package names are supplied remotely, suggesting experimentation with performance degradation, evasion, monetization, or future AI-assisted functionality. Overall, SURXRAT is best characterized as a financially motivated Android MaaS operation focused on surveillance, remote control, data theft, and device-level extortion.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.