RatHat's operators are assessed to be based in China

Assessment

Zimperium's zLabs team attributes RatHat's operators to likely China-based threat actors, but the stated basis for this assessment is narrow: the prompts the malware sends to its embedded generative AI assistant are written in Mandarin. None of the reporting reviewed — including Zimperium's own quoted findings — cites supporting infrastructure analysis (hosting, registrar, IP geolocation), campaign-targeting patterns, or any other independent corroborating signal. A reader could reasonably repeat "RatHat is a Chinese malware campaign" as an established fact when it is currently a single-vendor language-based inference.