BreakglassIntelligence
Back to reports

ASO RAT: Arabic-Language Android Surveillance Platform Targeting Syria

PublishedApril 10, 2026
androidratsurveillancesyriamobile-malwarec2-infrastructure

Published: April 10, 2026 TLP: WHITE Investigation ID: GHOST-2026-0410-ASO

Executive Summary

ASO RAT is a custom-built, Arabic-language Android Remote Access Trojan platform operating from Frankfurt-based infrastructure with direct ties to Syria. The platform provides full device compromise capabilities — SMS interception, camera access, GPS tracking, call logging, file exfiltration, and DDoS launching from victim devices — delivered through APKs disguised as PDF readers and Syrian government applications. A multi-user panel with role-based access control suggests this operates as a RAT-as-a-Service or supports a multi-operator team. The newest malware sample (March 2026) currently holds 0/66 antivirus detections.

This investigation was triggered by a public report from @solostalking on X, who identified the RAT and its primary C2 address. GHOST automated infrastructure mapping expanded that single indicator into a complete operational picture: two active C2 servers, four DDNS domains, eight malicious APK samples, historical infrastructure spanning four VPS providers and two Starlink satellite connections — one geolocated to Syria — and a fully reverse-engineered panel architecture exposing 20+ API endpoints, nine frontend routes, and 259 Arabic-language strings in the production JavaScript bundle.

Infrastructure

Active Command & Control

RoleAddressProviderLocation
Primary C245[.]74[.]4[.]179Secure Internet LLC / M247Frankfurt, DE
Secondary C2172[.]111[.]200[.]133Secure Internet LLC / CogentFrankfurt, DE

Both servers share the same WHOIS contact email: admin@pointtoserver[.]com, confirming common procurement.

Primary C2 — Open Ports

PortStateServiceDetails
80/tcpOpennginx 1.24.0Default nginx welcome page
137/udpOpenNetBIOSNetBIOS Name Service
445/tcpOpenSMBServer Message Block — unusual for a C2 server
3000/tcpOpennginx 1.24.0ASO RAT C2 Panel (reverse proxy to Django)
8080/tcpOpenuvicornDjango REST API + Django admin panel
8090/tcpOpenHTTPFile Browser v2.62.2
22/tcpFilteredSSHFirewalled
443/tcpFilteredHTTPSNo TLS configured

Shodan reports two vulnerabilities against this host: CVE-2023-44487 (HTTP/2 Rapid Reset) and CVE-2025-23419 (nginx TLS session resumption bypass).

The presence of NetBIOS (137/udp) and SMB (445/tcp) on an internet-facing C2 server is a notable OPSEC failure — these are Windows file-sharing services that have no legitimate purpose on a Linux C2 host and expand the attack surface.

Secondary C2 — 172[.]111[.]200[.]133

The secondary C2 mirrors the primary's architecture:

  • Port 8080 — Identical Django REST API framework with Django Admin interface at /admin/
  • Port 8090 — Hosts a custom "Secure Access | System" page with password-only authentication, distinct from the File Browser on the primary server

The secondary's port 8090 page contains Arabic CSS comments in its source code:

/* أنيميشن الخلفية الفخمة */

Translation: "Luxurious background animation" — indicating the same Arabic-speaking developer built both the RAT panel and this custom access portal.

DDNS Domains

DomainNotes
c-pdf[.]ddns[.]netPDF lure theme, points to primary C2
new-pdf[.]ddns[.]netHardcoded in JS bundle, points to secondary C2
livemap-back[.]ddns[.]netMap/geolocation lure theme, rotated across multiple hosts
aso[.]ddns[.]netProject name; resolved to residential Spanish IP

All domains use No-IP dynamic DNS, enabling rapid infrastructure rotation without registrar paper trails.

Full Historical DNS Resolution Table

DomainIPDateProvider
c-pdf[.]ddns[.]net45[.]74[.]4[.]1792026-03-02Secure Internet LLC, Frankfurt
new-pdf[.]ddns[.]net172[.]111[.]200[.]1332026-03-11Secure Internet LLC, Frankfurt
new-pdf[.]ddns[.]net129[.]224[.]207[.]2152025-12-09SpaceX Starlink, US
livemap-back[.]ddns[.]net129[.]224[.]206[.]1952026-03-20SpaceX Starlink, SYRIA
livemap-back[.]ddns[.]net45[.]74[.]4[.]1792025-09-13Secure Internet LLC, Frankfurt
livemap-back[.]ddns[.]net136[.]144[.]35[.]162025-05-07Latitude.sh, US

Infrastructure Timeline

May 2025:  livemap-back[.]ddns[.]net → 136[.]144[.]35[.]16 (Latitude.sh, US)
Jul 2025:  First APK samples submitted to VT (GovLens.apk, pdf-sec.apk)
Sep 2025:  livemap-back[.]ddns[.]net → 45[.]74[.]4[.]179 (current primary, Frankfurt)
Oct 2025:  c-pdf.apk submitted to VT (18/66 detections)
Dec 2025:  new-pdf[.]ddns[.]net → 129[.]224[.]207[.]215 (Starlink, US)
           SyriaDefenseMap.apk submitted (23/67 detections)
Mar 2026:  livemap-back[.]ddns[.]net → 129[.]224[.]206[.]195 (Starlink, SYRIA)
           new-pdf[.]ddns[.]net → 172[.]111[.]200[.]133 (second Frankfurt VPS)
           c-pdf.apk (NEW, com.pdf.ironclad) — 0/66 detections
           ironclad-pdf.apk → new-pdf[.]ddns[.]net (3 detections)
Apr 2026:  C2 panel still active and operational

The timeline shows steady evolution: early samples used hardcoded IPs, mid-period samples adopted DDNS for resilience, and the latest samples achieve near-zero detection rates — indicating the operator is actively iterating on evasion.

Panel Architecture — Reverse Engineering

GHOST extracted and analyzed the minified JavaScript bundle served by the C2 panel on port 3000. Despite minification, the bundle retained full API route definitions, React component structures, and 259 Arabic-language UI strings.

API Endpoints

Twenty-one API endpoints were recovered from the bundle, revealing the full command-and-control protocol:

EndpointMethodFunction
/api/token/POSTJWT authentication
/api/token/refresh/POSTToken refresh
/api/devices/GETList compromised devices
/api/devices/{id}/assign-group/POSTAssign device to campaign group
/api/ddos/GET/POSTDDoS attack management
/api/ddos/{id}/{action}_attack/POSTStart/stop DDoS attacks
/api/ddos/bulk-delete/POSTBulk delete DDoS entries
/api/build-apk/build/POSTGenerate malicious APK on demand
/api/downloads/GETManage exfiltrated data
/api/downloads/delete-multiple/POSTBulk delete downloads
/api/upload/front/POSTUpload files to C2
/api/fcm/send/POSTFirebase Cloud Messaging push to victims
/api/auto-download-tasks/GET/POSTAutomated exfiltration tasks
/api/delayed-commands/GET/POSTScheduled commands to victims
/api/assets/GET/POSTManage APK builder assets (icons)
/api/dashboard/stats/GETDashboard statistics
/api/system-settings/GETSystem configuration
/api/users/me/GETCurrent user profile
/api/users/GETUser management
/api/groups/GETDevice group management
/api/search/GETSearch functionality

Notable findings:

  • /api/build-apk/build/ — The panel includes a full APK builder that generates new malware payloads server-side. Operators can customize app names, icons (managed via /api/assets/), and C2 callback addresses without touching Android Studio.
  • /api/fcm/send/ — Firebase Cloud Messaging integration allows operators to push commands to victim devices even when the RAT is dormant, using Google's own infrastructure as a wake-up channel.
  • /api/delayed-commands/ — Scheduled command execution enables time-delayed tasking, useful for coordinating exfiltration during off-hours when victims are less likely to notice battery or data anomalies.
  • /api/auto-download-tasks/ — Automated exfiltration rules can be configured to continuously siphon specific file types or data categories without manual operator intervention.

Panel Frontend Routes

RouteFunction
/dashboardMain dashboard with statistics
/devicesCompromised device management
/:deviceIdIndividual device view with all stolen data
/builderAPK builder interface
/ddos-attackDDoS attack management
/ddos-attack/add-attackLaunch new DDoS attack
/groupsDevice grouping (campaigns)
/usersMulti-user panel management
/settingsSystem settings

The /groups route and the assign-group API confirm that operators organize victims into campaign groups — consistent with targeted surveillance operations rather than opportunistic mass infection.

Arabic UI Strings

259 Arabic strings were retained in the minified production bundle, confirming the developer's native language. These are not machine-translated — grammar and terminology are consistent with a native Arabic speaker building a tool for Arabic-speaking operators. Key examples:

ArabicTranslationContext
إخفاء أيقونة التطبيقHide app iconStealth mode toggle
إظهار أيقونة التطبيقShow app iconReveal mode toggle
التطبيق مخفي حاليًاApp is currently hiddenStatus indicator
الوصول إلى الموقعAccess to locationGPS permission
الوصول إلى جهات الاتصالAccess to contactsContact permission
الوصول الكامل للملفاتFull file accessStorage permission
إرسال الإشعاراتSend notificationsFCM push
خطأ أثناء بناء الـ APKError while building APKBuilder error
فشل بناء التطبيقApplication build failedBuilder error
استثناء من توفير البطاريةBattery optimization exemptionPersistence
إنشاء مستخدم جديدCreate new userMulti-user admin
الصلاحيات والأدوارPermissions and rolesRBAC system
التنزيلات المكتملةCompleted downloadsExfiltration status

The string استثناء من توفير البطارية ("Battery optimization exemption") is particularly telling — it indicates the RAT requests Android's battery optimization whitelist to maintain persistent background execution, a well-known mobile malware persistence technique.

Malware Analysis

Capabilities

The C2 panel and APK payloads support the following operations on compromised Android devices:

  • SMS interception and exfiltration — Real-time capture of all incoming/outgoing messages
  • Call log harvesting — Complete call history extraction
  • Contact list theft — Full address book exfiltration
  • Camera capture — Front and rear camera access for covert photography
  • GPS location tracking — Continuous or on-demand geolocation
  • File system access — Browse and exfiltrate arbitrary files from device storage
  • Notification interception — Capture notifications from all apps (including messaging apps)
  • Clipboard monitoring — Passive capture of copied text (passwords, OTPs, messages)
  • App icon hiding — Stealth persistence by removing the app from the home screen
  • Battery optimization bypass — Request exemption from Android's battery saver to maintain persistence
  • DDoS attack launching — Weaponize victim devices as DDoS nodes
  • On-demand APK building — Generate new customized malware payloads from the panel
  • Firebase Cloud Messaging — Push commands to victims via Google's FCM infrastructure
  • Automated exfiltration — Schedule recurring data theft tasks without operator intervention
  • Delayed command execution — Time-delayed tasking for coordinated operations

Malicious APK Samples

Eight samples were identified across VirusTotal, themed as PDF readers, government applications, and military mapping tools:

#SHA256 (truncated)NamePackageDetectionsFirst SeenC2 Domain
1050537a4...pdf-sec.apkcom.pdf.readersec6/662025-09-2545[.]74[.]4[.]179 (direct)
22eda2c83...c-pdf.apkcom.pdf.ironclad0/662026-03-02c-pdf[.]ddns[.]net
339901ffa...GovLens.apkgov.lens.net5/652025-07-2545[.]74[.]4[.]179 (direct)
43b5adb76...pdf-sec.apkcom.pdf.readersec3/662025-07-2845[.]74[.]4[.]179 (direct)
586ebb2e4...SyriaDefenseMap.apkcom.cpdf.cpdf23/672025-12-08livemap-back[.]ddns[.]net
6ee90df06...c-pdf.apkcom.pdf.readersec18/662025-10-15livemap-back[.]ddns[.]net
7ffcfee12...(unnamed)com.pdf.readersec11/672025-09-1345[.]74[.]4[.]179 (direct)
8c725498c...ironclad-pdf.apk(unknown)3/?~2026-03new-pdf[.]ddns[.]net

Detection trend: Early samples (Jul-Sep 2025) used hardcoded IPs and accumulated 3-11 detections. Mid-period samples (Oct-Dec 2025) transitioned to DDNS and reached 18-23 detections as AV vendors caught up. The latest samples (Mar 2026) use new package names and fresh DDNS domains to achieve 0-3 detections — the operator is actively evading signature-based detection.

Lure analysis: The Syria-themed lures — "SyriaDefenseMap" and "GovLens" — indicate deliberate targeting of individuals with interest in Syrian military or governance matters. This is consistent with surveillance operations against opposition figures, journalists, NGO workers, or military personnel in the Syrian conflict. The shift from government lures to generic PDF reader themes in later samples may indicate broadening of the target set or an attempt to make distribution less conspicuous.

OPSEC Failures

The operator made several mistakes that aided attribution and infrastructure mapping:

  1. Hardcoded developer IP — 192[.]168[.]1[.]112 left in the production JavaScript bundle, exposing the developer's local network configuration and confirming the panel was developed on a home/office network.

  2. Hardcoded C2 domain — new-pdf[.]ddns[.]net embedded in the minified JS bundle, linking the panel directly to the secondary C2 infrastructure that was otherwise not publicly associated with the primary server.

  3. Code typo — API route /dods-attack/update/:id instead of /ddos-attack/, confirming the DDoS module exists and revealing hasty development with insufficient code review.

  4. User enumeration — The JWT token endpoint (/api/token/) returns different error messages for invalid usernames vs. invalid passwords, enabling account discovery on the multi-user panel.

  5. Arabic strings retained — 259 Arabic-language strings left in the minified production build. A competent operator would strip these during the build process. Their presence confirms the developer's native language and provides linguistic fingerprinting material.

  6. Residential IP exposure — A Telefonica de Espana residential address (88[.]3[.]137[.]237) resolved on aso[.]ddns[.]net, potentially identifying the developer's or an operator's physical location in Spain.

  7. SMB/NetBIOS on C2 — Ports 137 and 445 open on the primary C2 server expose Windows file-sharing services that have no operational purpose and expand the server's attack surface.

  8. No TLS — All C2 communications occur over unencrypted HTTP. The panel login, JWT tokens, victim data, and operator commands traverse the network in plaintext, making the entire operation vulnerable to passive interception.

  9. Arabic CSS comments on secondary C2 — The custom "Secure Access | System" page on 172[.]111[.]200[.]133:8090 contains Arabic CSS comments (/* أنيميشن الخلفية الفخمة */), further linking the developer to both servers and confirming the same individual built multiple components of the infrastructure.

Attribution Assessment

IndicatorAssessment
Developer languageArabic (native — 259 UI strings, Arabic CSS comments, natural grammar)
Geographic nexusSyria (Starlink IP 129[.]224[.]206[.]195 geolocates to Syria + Syria-themed military/government lures)
Secondary nexusSpain (residential Telefonica IP 88[.]3[.]137[.]237 on operator DDNS domain aso[.]ddns[.]net)
InfrastructureFrankfurt, Germany (two VPS from Secure Internet LLC, same WHOIS contact)
Skill levelIntermediate-advanced (custom Django/React C2, APK builder, RBAC, FCM integration, multi-server infra; undermined by systemic OPSEC failures)
Operational modelRAT-as-a-Service or multi-operator team (RBAC panel with user management and role-based permissions)
Activity windowAt least May 2025 to present (active as of April 2026, ~11 months)
TargetingSyrian opposition, journalists, NGO workers, military personnel (inferred from lure themes)

The combination of Arabic-language development, Syria-geolocated Starlink infrastructure, and Syria-themed military lures points to an operator with direct ties to the Syrian conflict — likely conducting surveillance operations against individuals of interest in the Syrian theater. The Spanish residential IP may indicate the developer or a secondary operator is based in Spain, possibly among the Syrian diaspora community.

MITRE ATT&CK Mapping

Technique IDNameContext
T1587.001Develop Capabilities: MalwareCustom Android RAT with server-side APK builder
T1583.001Acquire Infrastructure: DomainsFour No-IP DDNS domains for C2 rotation
T1583.003Acquire Infrastructure: Virtual Private ServerTwo Frankfurt VPS from Secure Internet LLC (M247/Cogent)
T1584.005Compromise Infrastructure: BotnetDDoS module weaponizes victim devices as attack nodes
T1566.002Phishing: Spearphishing LinkAPK distribution via lure-themed downloads
T1204.002User Execution: Malicious FileVictim installs disguised APK (PDF reader, government app)
T1636.004Protected User Data: SMS MessagesSMS interception and exfiltration module
T1636.002Protected User Data: Call LogCall log harvesting
T1636.003Protected User Data: Contact ListContacts exfiltration
T1512Video CaptureCamera access (front and rear)
T1430Location TrackingGPS monitoring via location permissions
T1629.003Impair Defenses: Hide ArtifactsApp icon hiding for stealth persistence
T1629.006Impair Defenses: Device LockoutBattery optimization exemption for persistent execution
T1481.002Web Service: Bidirectional CommunicationC2 via Django REST API on port 8080
T1481.003Web Service: One-Way CommunicationFile exfiltration via File Browser on port 8090
T1498Network Denial of ServiceDDoS module launches attacks from victim devices
T1509Non-Standard PortC2 services on ports 3000, 8080, 8090 instead of standard HTTP/HTTPS

What This Report Adds to the Public Record

  • Complete infrastructure map from a single IP indicator: two C2 servers, four DDNS domains, six historical IP resolutions across four providers including Starlink satellite internet
  • Full panel reverse engineering: 21 API endpoints, 9 frontend routes, and the Django/React architecture documented for detection engineering and threat hunting
  • Eight malicious APK samples with full hashes, package names, detection ratios, first-seen dates, and C2 callback domains
  • Arabic linguistic analysis: 259 UI strings and CSS comments providing attribution-grade linguistic evidence
  • Syria nexus established through Starlink geolocation (129[.]224[.]206[.]195) and military/government lure theme analysis
  • Infrastructure timeline (May 2025 — April 2026) showing operational evolution from hardcoded IPs to DDNS with improving AV evasion
  • Secondary C2 discovery (172[.]111[.]200[.]133) linked via WHOIS, shared API framework, and developer fingerprints
  • OPSEC failure catalog (9 failures) enabling further attribution research by the community
  • Detection engineering data: API endpoint patterns, port signatures, and network indicators for IDS/IPS rule development

Indicators of Compromise

IP Addresses

45[.]74[.]4[.]179          # Primary C2, Secure Internet LLC, Frankfurt
172[.]111[.]200[.]133      # Secondary C2, Secure Internet LLC, Frankfurt
216[.]128[.]9[.]226        # Starlink, Italy — livemap-back current
129[.]224[.]206[.]195      # Starlink, SYRIA — historical
129[.]224[.]207[.]215      # Starlink, US — historical
136[.]144[.]35[.]16        # Latitude.sh, US — historical
88[.]3[.]137[.]237         # Telefonica residential, Spain — operator IP

Domains

c-pdf[.]ddns[.]net
new-pdf[.]ddns[.]net
livemap-back[.]ddns[.]net
aso[.]ddns[.]net

URLs

hxxp://45[.]74[.]4[.]179:3000/           # ASO RAT panel
hxxp://45[.]74[.]4[.]179:8080/admin/     # Django admin (primary)
hxxp://45[.]74[.]4[.]179:8090/           # File Browser (primary)
hxxp://172[.]111[.]200[.]133:8080/admin/ # Django admin (secondary)
hxxp://172[.]111[.]200[.]133:8090/login  # Secure Access System (secondary)

Email

admin@pointtoserver[.]com    # Hosting NOC contact on both C2 servers

File Indicators (SHA256)

050537a47b5463e96a9f3e7ba79c607017faceeb668cef8aa1d5e11a19ff4990
2eda2c838ea696f6ab1e74d2a1fa3c265234a32416a666f0efa3d065d0185552
39901ffa746a6f6ac3de2b36d9e61e0d60b221f4d9510436fd3cb3d2d7362130
3b5adb76e37e4cc999e281068d1f3e6f82cab8055c6b46c2e6de1b6ea8499a7e
86ebb2e4384e3c0d4aa973c07c1d237e3f4042c773f4b2aa5fcd19d8f7383172
ee90df061740b8cf0cdce8dba04ff34c205adf3271695e5310d04723dd9a2a47
ffcfee12bd160dc67f9b0fbd4462e46e5932840297c611ad2646139295ea019c
c725498c...                                                         # ironclad-pdf.apk (partial hash)

Android Package Names

com.pdf.readersec
com.pdf.ironclad
com.cpdf.cpdf
gov.lens.net

Network Signatures

Port 3000/tcp — nginx reverse proxy to Django/React panel
Port 8080/tcp — uvicorn (Django REST API + admin)
Port 8090/tcp — File Browser v2.62.2 (primary) / custom auth page (secondary)
API pattern: /api/token/, /api/devices/, /api/build-apk/build/, /api/fcm/send/

Initial lead credit: @solostalking

GHOST — Breakglass Intelligence https://intel.breakglass.tech

Share