RatHat FRP Reverse Tunnel C2 Connection from Compromised Android Device

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•2

This rule detects network traffic patterns associated with the RatHat malware, specifically the use of 'frpc' (Fast Reverse Proxy Client) to establish a persistent reverse proxy tunnel. The rule monitors for established outbound connections containing the specific byte sequence characteristic of this tool, which is often used by adversaries to facilitate Command and Control (C2) communication.