Why IOCs Matter for ZeroDayRAT
Indicators of compromise are the foundation of detection, but they have a shelf life. ZeroDayRAT, like any commercial RAT, gets updated. C2 domains rotate, payloads get recompiled, and hashes change. The most durable detections are behavioral, they look for what the spyware does, not just what it looks like. This guide from the ZeroDayRAT Intelligence Center covers both atomic IOCs and behavioral indicators, with the understanding that behavioral detection is what will keep working over time.
For the full set of detection rules including YARA, Snort, Sigma, and KQL, see our technical report. This article focuses on the indicators themselves and how to think about them.
Network Indicators
C2 Communication Patterns
ZeroDayRAT implants communicate with their C2 over HTTP or WebSocket connections. The traffic is often encrypted, but the communication pattern is distinctive. Look for periodic beaconing to a single host, small request sizes with larger responses, and connections to domains registered within the last 90 days.
Network IOCs to watch for include connections to recently registered domains with no legitimate reputation, TLS certificates with suspicious or self-signed issuers, HTTP POST requests to dynamic paths like /api/update or /gate.php, and WebSocket connections to non-standard ports. These are not unique to ZeroDayRAT, but the combination is a strong signal.
DNS Indicators
DNS is one of the best detection surfaces because it is hard to hide. ZeroDayRAT C2 domains tend to share characteristics: recently registered, privacy-protected WHOIS, hosted on bulletproof or offshore hosting providers, and resolving to IPs in regions with lax cybercrime enforcement. If you see a device making DNS queries to a domain that was registered two weeks ago and is hosted on an unknown provider, that is worth investigating.
For enterprise detection, our detection guide covers DNS-based hunting strategies in detail, including passive DNS analysis and DNS firewall rules.
Known C2 Infrastructure
Specific C2 domains and IPs are published in our technical report and updated as new infrastructure is identified. I am intentionally not publishing raw IOCs in this article because they change frequently and stale IOCs create false confidence. The technical report is the living document for that.
Host-Based Indicators (Android)
Package Characteristics
ZeroDayRAT Android payloads share characteristics that are detectable. They are typically distributed as APK files outside the Play Store, they request an unusually broad permission set, and they often disguise themselves as utility apps, system updates, or legitimate services.
The package name may vary because the builder generates unique packages, but the permission pattern is consistent. Look for apps requesting accessibility service, SMS read and receive, location, camera, microphone, notifications, and device admin in a single package. No legitimate app needs all of these.
File System Artifacts
On a compromised Android device, look for unexpected APK files in the Downloads directory, apps installed from unknown sources, hidden or disguised app icons, and unusual files in app data directories. The implant may hide its icon after installation, which is a strong indicator by itself. A user who did not install an app but sees one in the app list should investigate immediately.
Accessibility Service Abuse
The accessibility service is the single most abused Android feature by spyware. ZeroDayRAT uses it for keylogging, overlay attacks, and interaction hijacking. Check Settings > Accessibility for any app you do not recognize. Legitimate accessibility apps are rare and usually obvious, screen readers, switch access, and known manufacturer tools. Anything else is suspicious.
For a full mapping of which Android permissions enable which spyware capabilities, see our capability-to-permission map.
Host-Based Indicators (iOS)
iOS indicators are harder to find because of the platform's restrictions, but they exist. Look for configuration profiles you did not install (Settings > General > VPN and Device Management), MDM enrollment you did not authorize, enterprise certificate apps that are not from your organization, and custom keyboards. Also check analytics data for anomalies using tools like MVT.
Our iOS security guide covers iOS-specific detection including Lockdown Mode, which is the single most effective defensive measure for high-risk iOS users.
Behavioral Indicators
Permission Patterns
The most reliable behavioral indicator is the permission combination. No legitimate app needs accessibility plus SMS plus notifications plus location plus camera. If you see this combination, it is spyware until proven otherwise. This is true regardless of whether the app is ZeroDayRAT or any other commercial RAT.
Network Behavior
Periodic beaconing to a single unknown host is a strong indicator. The implant checks in with the C2 at regular intervals to receive commands and upload data. This creates a network pattern that stands out in proxy logs. Look for connections that happen at regular intervals (every few minutes), to the same host, with small request payloads.
Battery and Data Anomalies
Spyware that captures audio, video, or location continuously will drain battery faster than expected. It will also use more cellular data than the app should. If a user reports that their battery life suddenly dropped or their data usage spiked, and they recently installed an app from outside the Play Store, investigate.
Detection Rules
YARA Rules
YARA rules for ZeroDayRAT focus on string patterns in the APK, package structure, and builder artifacts. Because the builder generates unique packages, the most effective YARA rules target the C2 communication code and configuration handling, which tend to be consistent across builds. Specific YARA rules are published in our technical report.
Sigma and SIEM Rules
For enterprise SIEM, the most effective detections are correlation-based. Alert when a mobile device (identified by mobile VPN or MDM telemetry) connects to a recently registered domain, especially if the same device has an app with a dangerous permission combination. Alert when a device exhibits periodic beaconing patterns. Alert when a user installs an app from outside the managed app store.
For the full SIEM detection logic including Splunk SPL and KQL queries, see the technical report.
Threat Hunting Strategy
Start With Permissions
The most efficient hunt starts with permissions. Pull a list of all Android apps with accessibility service access across your fleet. Any app that is not a known accessibility tool is a candidate for investigation. This will catch ZeroDayRAT and most other commercial RATs in one pass.
Correlate With Network
Next, correlate the permission data with network telemetry. Which of those devices with suspicious apps are communicating with unknown or recently registered domains? This narrows the field significantly.
Check Installation Source
Finally, check the installation source. Apps installed from outside the Play Store or your MDM app catalog are higher risk. Combine all three signals, suspicious permissions, suspicious network, and suspicious install source, and you have a high-confidence detection pipeline.
Limitations of IOC-Based Detection
IOC-based detection has a fundamental limitation: it only catches what you already know about. ZeroDayRAT will update its infrastructure, change its package signatures, and evolve its techniques. Behavioral detection is more durable because the underlying behaviors, accessing accessibility, intercepting SMS, beaconing to a C2, are harder to change without breaking the spyware's functionality.
For this reason, the ZeroDayRAT Intelligence Center recommends a defense-in-depth approach that combines IOC matching, behavioral detection, and user education. No single layer is sufficient.
Frequently Asked Questions
Where can I find ZeroDayRAT IOCs?
ZeroDayRAT IOCs including C2 domains, file hashes, and package names are published in the ZeroDayRAT Intelligence Center technical report at zerodayrat.shop/technical-report. IOCs are updated as new infrastructure is identified.
How often do ZeroDayRAT IOCs change?
ZeroDayRAT C2 infrastructure rotates frequently, often every few weeks. File hashes change with every builder run. For this reason, behavioral indicators are more durable than atomic IOCs for long-term detection.
What is the most reliable ZeroDayRAT indicator?
The most reliable indicator is the permission combination. An app requesting accessibility plus SMS plus notifications plus location plus camera is spyware until proven otherwise, regardless of whether it is ZeroDayRAT specifically.
Can ZeroDayRAT evade detection?
ZeroDayRAT can change its package signature and C2 infrastructure, but it cannot easily change its behavior. It still needs accessibility for keylogging, SMS access for OTP interception, and network access for C2 communication. Behavioral detection catches what signature-based detection misses.
How do I report ZeroDayRAT IOCs?
Share ZeroDayRAT IOCs with your threat intelligence platform, MISP community, or directly with the ZeroDayRAT Intelligence Center through our contact page. IOC sharing helps the broader defensive community detect infections faster.
