ViperRAT
MITRE ATT&CK: S0506 View on attack.mitre.org
Aliases: ViperRAT
- First seen
- 2015-01-01 00:00:00
- Malware type
- spyware, rat
- Family
- Malware family
- Operating systems
- android
- Related IoCs
- 179 (1 malicious)
- Last IoC activity
- 2026-08-28 10:05:01
- Profile updated
- 2026-07-07 15:29:20
Targeted industries: defense-and-aerospace government-and-public-sector
Targeted regions: country_code:il
Context
ViperRAT is sophisticated surveillanceware that has been in operation since at least 2015 and was used to target the Israeli Defense Force.
Recent IoC activity
1 malicious indicator in Maltiverse are attributed to ViperRAT (S0506). The 1 most recently updated:
| Type | Indicator | Updated | Sources |
|---|---|---|---|
| IP address | 162.14.116.65 | 2026-08-15 | 2 |
Malware & tools used
- Download New Code at Runtime (attack-pattern)
- Match Legitimate Name or Location (attack-pattern)
- Contact List (attack-pattern)
- Video Capture (attack-pattern)
- System Information Discovery (attack-pattern)
- Location Tracking (attack-pattern)
- System Network Configuration Discovery (attack-pattern)
- Data from Local System (attack-pattern)
- Call Log (attack-pattern)
- System Network Connections Discovery (attack-pattern)
- Internet Connection Discovery (attack-pattern)
- Audio Capture (attack-pattern)
- SMS Messages (attack-pattern)
Reports & references
- MITRE ATT&CK — S0506 (report)
- blog.lookout.com — Viperrat Mobile Apt (report)