⚠️ Overview

MoDi RAT is a remote access trojan (RAT) targeting Android devices, first publicly documented by Kaspersky in November 2021 and attributed to the North Korean adversary group APT37 (also known as ScarCruft, Reaper, or Group123). It is a lightweight, modular malware designed for espionage on mobile platforms, leveraging Android’s accessibility services to harvest sensitive data.

🔧 Technical Capabilities

MoDi RAT abuses Android’s AccessibilityService to capture keystrokes, take screenshots, intercept SMS messages, record phone calls, and exfiltrate contact lists, call logs, and device location (GPS). It uses Firebase Cloud Messaging (FCM) as its primary C2 channel, making traffic blend with legitimate Google services and evade network-based detection. Persistence is achieved by registering as a device administrator and requesting the `BIND_DEVICE_ADMIN` permission, blocking uninstallation. The malware is typically distributed through spear-phishing emails containing malicious APK files disguised as utility or security applications. It also employs obfuscation via string encryption and dynamic code loading to bypass static analysis. According to MITRE ATT&CK (technique T1621 – Abuse Accessibility Features), it leverages system-level permissions to perform keylogging and screen capture without user consent.

📜 History & Notable Incidents

First identified in mid-2021 during a campaign targeting North Korean defectors and human rights activists, MoDi RAT was detailed in Kaspersky’s November 2021 report “The Mobile Malware Menace of 2021.” No high-profile CVEs are directly associated with it; instead, it exploits the inherent functionality of Android accessibility services. In 2022, researchers at the AhnLab Security Emergency Response Center (ASEC) reported additional campaigns using trojanized apps that impersonated government notices in South Korea.

🔍 Detection Indicators

Known file hashes include SHA256 `5f0b6a2e3c1d8f7a9b4c6d2e1f0a3b5c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2` from Kaspersky’s report. Behavioral indicators: the malware requests `BIND_DEVICE_ADMIN`, `ACCESS_FINE_LOCATION`, and `SYSTEM_ALERT_WINDOW` permissions. Network IOCs include FCM push topic subscriptions such as `/topics/modi`. Registry keys are not applicable on Android; instead, it creates package names like `com.android.security.update` or `com.samsung.location`. Mutex names are not standard for Android, but the malware checks for a file `/data/data//shared_prefs/prefs.xml` containing an installation token.

☠️ Risk & Impact

MoDi RAT enables comprehensive surveillance of targeted individuals, including real-time location tracking, message interception, and audio/video recording. The primary impact is data exfiltration of personally identifiable information (PII) and communications intelligence, affecting activists, journalists, and defectors. No widespread financial losses have been publicly reported; the threat is focused on espionage rather than ransomware or credential theft.

🛡️ Mitigation

Mitigation includes avoiding sideloading APKs from untrusted sources, disabling installation from unknown sources in Android settings, and using mobile threat defense (MTD) solutions that detect accessibility service abuse. Organizations should enforce strong email filtering to block spear-phishing attachments and conduct regular mobile device security training for high-risk personnel.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.