RatHat ADB Certificate and Private Key Exfiltration to C2

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•3

Detects HTTP POST requests to a specific API endpoint (/api/adbk/upload) containing references to 'cert.pem' and 'private.key', indicating the exfiltration of sensitive cryptographic material by the RatHat malware.