RatHat FRP Tunnel Config Retrieval via WebSocket /ws/lnk Endpoint

Ibrahim Saud@tektrix

•updated 7 days ago•0•0•0

Detects network activity associated with the RatHat Android malware, specifically focusing on its use of WebSocket-based FRP (Fast Reverse Proxy) tunnels for command and control, session initialization, configuration retrieval, and local loopback proxy communication.