Executive Summary
Hagaseca is a sophisticated Android malware cluster active since late 2024, characterized by the use of packed loaders (THost4, THost9) to deliver a potent remote access trojan (tc9.dex). The campaign primarily targets systems with exposed Android Debug Bridge (ADB) services, including physical phones and cloud-based Redroid (Android in Docker) containers. While Darkatlas Squad notes the cluster's persistence, specific attribution to threat actors like Storm-2697 is often linked through broader infrastructure tracking in related intelligence.
The attack chain involves a multi-stage execution process where an initial APK decodes an embedded XOR-encrypted asset to load the RAT stage. Once active, the malware utilizes Android Accessibility Services to gain comprehensive UI control, bypassing traditional user interactions. The tc9.dex stage features worm-like capabilities, performing /16 network scans to discover and infect additional vulnerable ADB endpoints using prepared key material.
The impact is significant for organizations using Android-based cloud infrastructure or mobile fleets. The malware establishes robust persistence through boot receivers and foreground services that self-recover within seconds of termination. Affected devices face total remote takeover, file exfiltration, and role as a pivot point for further lateral movement via ADB propagation.