S0489: WolfRAT

WolfRAT is Android malware, based on leaked Dendroid code, with reporting indicating it primarily targeted Thai users. Its ATT&CK relationships make it material for mobile risk because it combines evasion, runtime code download, device and app discovery, and collection of sensitive mobile data such as audio, video, screen content, notifications, SMS, call logs, contacts, and local files.

Executive priority

Treat WolfRAT as a mobile surveillance and data-exposure planning case rather than just a malware name. Leaders should ask whether Android devices used for business have enforceable app governance, permission monitoring, mobile incident response procedures, and evidence collection for suspicious access to microphone, camera, notifications, SMS, contacts, call logs, local files, and runtime code loading. This matters for executive communications, regulated data handling, identity verification workflows that rely on mobile notifications or SMS, and resilience of bring-your-own-device or managed Android programs.

Technical view

ATT&CK does not provide a detection section for WolfRAT, so validation should be relationship-driven. SOC, mobile security, and IR teams should confirm visibility into Android applications that use obfuscated files, download code after installation, enumerate installed software or running processes, inspect network configuration, access notifications, control or read SMS, access call logs and contacts, collect local files, capture audio/video/screen content, perform system checks suggestive of sandbox or emulator avoidance, delete files, or mimic legitimate names, icons, package names, or locations. Because runtime code download and obfuscation can reduce static-analysis value, teams should validate both pre-install app review and post-install behavioral telemetry.

Likely telemetry

Android app inventory, package name, application label, icon, install source, and update history
Requested and granted Android permissions, especially microphone, camera, notification access, SMS, contacts, call log, storage, and administrator-style capabilities where available
Mobile device management or enterprise mobility management compliance events for managed Android devices
Mobile threat defense or endpoint telemetry for runtime code loading, dynamic payload retrieval, obfuscated content, and suspicious app behavior
Network telemetry from mobile devices or secure gateways showing unusual application connections or downloads after installation

Detection direction

Do not rely only on app-store or static APK scanning; T1407 indicates runtime code download can shift malicious behavior until after installation.
Prioritize behavior-based detections for unusual combinations of permissions and actions, such as notification access plus SMS access, or microphone/camera access plus network transfer.
Tune for Android apps whose names, icons, package names, or locations approximate trusted applications, while allowing for legitimate brand or system-app naming to reduce false positives.
Correlate discovery behaviors such as installed-app enumeration, process discovery, and network configuration checks with later collection behaviors to distinguish ordinary app functionality from suspicious multi-stage behavior.
Account for false positives from legitimate communications, backup, device-management, accessibility, or security applications that may request broad permissions for valid reasons.

Mitigation priorities

Enforce Android app governance: restrict untrusted installation sources, maintain approved app lists where practical, and review apps that mimic legitimate names or icons.
Use managed-device controls where available to limit high-risk permissions and monitor grants for microphone, camera, notification access, SMS, contacts, call logs, and storage.
Pair static mobile app vetting with behavioral monitoring capable of identifying post-install code downloads and suspicious runtime activity.
Define mobile IR procedures for isolating a suspected Android device, preserving relevant app, permission, network, and file evidence, and assessing exposure of SMS-based codes, notifications, contacts, call logs, and local files.
Educate users and support teams to escalate unexpected permission prompts, suspicious SMS activity, missing notifications, or apps that appear to impersonate trusted software.

Additional notes and limits

The supplied ATT&CK object identifies WolfRAT as Android malware based on a leaked version of Dendroid and notes reporting that it primarily targeted Thai users and was most likely operated by the now defunct Wolf Research organization. The object has no aliases, no explicit tactics listed, and no official detection text. The most useful defensive interpretation comes from the listed technique relationships, which describe evasion, discovery, collection, SMS interaction, file deletion, and impersonation-style behaviors on Android.

This take is limited to the supplied ATT&CK fields, external references, and relationships. It does not establish current activity, customer exposure, guaranteed detection, specific indicators, or confirmed attribution beyond the official description. Local device management, mobile telemetry, app inventory, and network evidence are required to determine actual risk and coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

WolfRAT

WolfRAT is malware based on a leaked version of Dendroid that has primarily targeted Thai users. WolfRAT has most likely been operated by the now defunct organization Wolf Research.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques17 rows

Domain	ID	Name	Relationship / procedure
Mobile	T1422	System Network Configuration Discovery	WolfRAT sends the device’s IMEI with each exfiltration request.[1]
Mobile	T1636.002	Call LogSub-technique	WolfRAT can collect the device’s call log.[1]
Mobile	T1630.002	File DeletionSub-technique	WolfRAT can delete files from the device.[1]
Mobile	T1418	Software Discovery	WolfRAT can obtain a list of installed applications.[1]
Mobile	T1429	Audio Capture	WolfRAT can record call audio.[1]
Mobile	T1512	Video Capture	WolfRAT can take photos and videos.[1]
Mobile	T1513	Screen Capture	WolfRAT can record the screen and take screenshots to capture messages from Line, Facebook Messenger, and WhatsApp.[1]
Mobile	T1636.004	SMS MessagesSub-technique	WolfRAT can collect SMS messages.[1]
Mobile	T1582	SMS Control	WolfRAT can delete and send SMS messages.[1]
Mobile	T1636.003	Contact ListSub-technique	WolfRAT can collect the device’s contact list.[1]
Mobile	T1533	Data from Local System	WolfRAT can collect user account, photos, browser history, and arbitrary files.[1]
Mobile	T1655.001	Match Legitimate Name or LocationSub-technique	WolfRAT has masqueraded as “Google service”, “GooglePlay”, and “Flash update”.[1]
Mobile	T1633.001	System ChecksSub-technique	WolfRAT can perform primitive emulation checks.[1]
Mobile	T1406	Obfuscated Files or Information	WolfRAT’s code is obfuscated.[1]
Mobile	T1424	Process Discovery	WolfRAT uses `dumpsys` to determine if certain applications are running.[1]
Mobile	T1407	Download New Code at Runtime	WolfRAT can update the running malware.[1]
Mobile	T1517	Access Notifications	WolfRAT can receive system notifications.[1]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.1
Object version: 1.0
Created: Jul 20, 2020, 13:27 UTC (UTC+00:00)
Modified: Apr 25, 2025, 14:40 UTC (UTC+00:00)
Raw hash: 107c5e7648280de4...

Imported snapshots across ATT&CK releases(1)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.0	Apr 25, 2025, 14:40 UTC (UTC+00:00)	Current bundle	`107c5e764828…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
Talos-WolfRAT
W. Mercer, P. Rascagneres, V. Ventura. (2020, May 19). The wolf is back... . Retrieved July 20, 2020.
Open source URL
[2]
Talos-WolfRAT
W. Mercer, P. Rascagneres, V. Ventura. (2020, May 19). The wolf is back... . Retrieved July 20, 2020.
Open source URL
[3]
mitre-attackS0489
Open source URL
[4]
mitre-attackS0489
Open source URL
[5]
Talos-WolfRAT
W. Mercer, P. Rascagneres, V. Ventura. (2020, May 19). The wolf is back... . Retrieved July 20, 2020.
Open source URL
[6]
Talos-WolfRAT
W. Mercer, P. Rascagneres, V. Ventura. (2020, May 19). The wolf is back... . Retrieved July 20, 2020.
Open source URL
[7]
Talos-WolfRAT
W. Mercer, P. Rascagneres, V. Ventura. (2020, May 19). The wolf is back... . Retrieved July 20, 2020.
Open source URL
[8]
Talos-WolfRAT
W. Mercer, P. Rascagneres, V. Ventura. (2020, May 19). The wolf is back... . Retrieved July 20, 2020.
Open source URL
[9]
Talos-WolfRAT
W. Mercer, P. Rascagneres, V. Ventura. (2020, May 19). The wolf is back... . Retrieved July 20, 2020.
Open source URL
[10]
Talos-WolfRAT
W. Mercer, P. Rascagneres, V. Ventura. (2020, May 19). The wolf is back... . Retrieved July 20, 2020.
Open source URL
[11]
Talos-WolfRAT
W. Mercer, P. Rascagneres, V. Ventura. (2020, May 19). The wolf is back... . Retrieved July 20, 2020.
Open source URL
[12]
Talos-WolfRAT
W. Mercer, P. Rascagneres, V. Ventura. (2020, May 19). The wolf is back... . Retrieved July 20, 2020.
Open source URL
[13]
Talos-WolfRAT
W. Mercer, P. Rascagneres, V. Ventura. (2020, May 19). The wolf is back... . Retrieved July 20, 2020.
Open source URL
[14]
Talos-WolfRAT
W. Mercer, P. Rascagneres, V. Ventura. (2020, May 19). The wolf is back... . Retrieved July 20, 2020.
Open source URL
[15]
Talos-WolfRAT
W. Mercer, P. Rascagneres, V. Ventura. (2020, May 19). The wolf is back... . Retrieved July 20, 2020.
Open source URL
[16]
Talos-WolfRAT
W. Mercer, P. Rascagneres, V. Ventura. (2020, May 19). The wolf is back... . Retrieved July 20, 2020.
Open source URL
[17]
Talos-WolfRAT
W. Mercer, P. Rascagneres, V. Ventura. (2020, May 19). The wolf is back... . Retrieved July 20, 2020.
Open source URL
[18]
Talos-WolfRAT
W. Mercer, P. Rascagneres, V. Ventura. (2020, May 19). The wolf is back... . Retrieved July 20, 2020.
Open source URL
[19]
Talos-WolfRAT
W. Mercer, P. Rascagneres, V. Ventura. (2020, May 19). The wolf is back... . Retrieved July 20, 2020.
Open source URL
[20]
Talos-WolfRAT
W. Mercer, P. Rascagneres, V. Ventura. (2020, May 19). The wolf is back... . Retrieved July 20, 2020.
Open source URL
[21]
Talos-WolfRAT
W. Mercer, P. Rascagneres, V. Ventura. (2020, May 19). The wolf is back... . Retrieved July 20, 2020.
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use