ViperRAT
MITRE ATT&CK: S0506 View on attack.mitre.org
Aliases: ViperRAT
- First seen
- 2015-01-01 00:00:00
- Malware type
- spyware, rat
- Family
- Malware family
- Operating systems
- android
- Related IoCs
- 203 (11 malicious)
- Last IoC activity
- 2026-10-18 01:14:01
- Profile updated
- 2026-07-07 15:29:20
Targeted industries: defense-and-aerospace government-and-public-sector
Targeted regions: country_code:il
Context
ViperRAT is sophisticated surveillanceware that has been in operation since at least 2015 and was used to target the Israeli Defense Force.
Recent IoC activity
11 malicious indicators in Maltiverse are attributed to ViperRAT (S0506). The 11 most recently updated:
| Type | Indicator | Updated | Sources |
|---|---|---|---|
| IP address | 107.173.248.142 | 2026-10-16 | 7 |
| IP address | 162.14.116.65 | 2026-10-07 | 2 |
| IP address | 81.70.224.95 | 2026-09-30 | 3 |
| IP address | 151.242.69.179 | 2026-09-30 | 1 |
| IP address | 134.175.151.226 | 2026-09-30 | 1 |
| IP address | 119.29.203.227 | 2026-09-30 | 1 |
| IP address | 118.195.176.52 | 2026-09-30 | 1 |
| IP address | 117.50.81.123 | 2026-09-30 | 1 |
| IP address | 154.219.123.78 | 2026-09-30 | 1 |
| IP address | 221.236.125.52 | 2026-09-30 | 1 |
| file sample | 15e47dc5e3dbff650db31879bc7269da49c3a865a402cd826e234cf7fabc0325 | 2026-09-24 | 1 |
Malware & tools used
- Download New Code at Runtime (attack-pattern)
- Match Legitimate Name or Location (attack-pattern)
- Contact List (attack-pattern)
- Video Capture (attack-pattern)
- System Information Discovery (attack-pattern)
- Location Tracking (attack-pattern)
- System Network Configuration Discovery (attack-pattern)
- Data from Local System (attack-pattern)
- Call Log (attack-pattern)
- System Network Connections Discovery (attack-pattern)
- Internet Connection Discovery (attack-pattern)
- Audio Capture (attack-pattern)
- SMS Messages (attack-pattern)
Reports & references
- MITRE ATT&CK — S0506 (report)
- blog.lookout.com — Viperrat Mobile Apt (report)