RatHat FRP Reverse Tunnel C2 Connection from Android ADB Daemon

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•1

Detects the initialization of an FRP (Fast Reverse Proxy) protocol connection, characterized by a specific 3-byte null sequence followed by the 'frp' string marker in the packet header. This pattern is often associated with the RatHat malware using FRP to establish covert reverse tunnels for command-and-control communication.