From BlackCat to Panda Workshop: Inside the Evolving C2 Panel Behind RATHat | Cleafy

This report documents the RATHat Android banking Trojan and its Malware-as-a-Service infrastructure, tracing its three C2 panel generations (BlackCat to Panda Workshop) and detailing how the operator builds, signs, and distributes samples from a centralized console. It covers the integrated AI features, device-targeting workflow, data exfiltration, and delivery chains, as well as indicators of compromise and deployment footprints across multiple regions in 2026.