Multiple Threat Actors Deploying Open-Source Rafel RAT to Target Android Devices

Several menace actors, including cyber espionage teams, are employing an open-resource Android remote administration device named Rafel RAT to fulfill their operational objectives by masquerading it as Instagram, WhatsApp, and various e-commerce and antivirus apps.

“It supplies malicious actors with a strong toolkit for distant administration and command, enabling a array of destructive activities from data theft to machine manipulation,” Verify Position stated in an examination printed final week.

It features a huge vary of features, these as the potential to wipe SD playing cards, delete get in touch with logs, siphon notifications, and even act as ransomware.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

The use of Rafel RAT by DoNot Group (aka APT-C-35, Brainworm, and Origami Elephant) was earlier highlighted by the Israeli cybersecurity business in cyber attacks that leveraged a design and style flaw in Foxit PDF Reader to trick users into downloading malicious payloads.

The marketing campaign, which took area in April 2024, is mentioned to have utilized army-themed PDF lures to supply the malware.

Verify Point explained it determined all over 120 diverse malicious campaigns, some concentrating on large-profile entities, that span a variety of international locations like Australia, China, Czechia, France, Germany, India, Indonesia, Italy, New Zealand, Pakistan, Romania, Russia, and the U.S.

“The bulk of victims had Samsung telephones, with Xiaomi, Vivo, and Huawei people comprising the 2nd-most significant group amid the targeted victims,” it famous, introducing no less than 87.5% of the contaminated devices are jogging out-of-day Android variations that no for a longer period obtain security fixes.

Normal attack chains require the use of social engineering to manipulate victims into granting the malware-laced apps intrusive permissions in buy to hoover sensitive details like get in touch with data, SMS messages (e.g., 2FA codes), locale, connect with logs, and the list of set up apps, amongst other individuals.

Rafel RAT mainly can make use of HTTP(S) for command-and-control (C2) communications, but it can also make use of Discord APIs to get in touch with the danger actors. It also comes with an accompanying PHP-primarily based C2 panel that registered people can leverage to issue commands to compromised devices.

The tool’s efficiency throughout many danger actors is corroborated by its deployment in a ransomware procedure carried out by an attacker probably originating from Iran, who despatched a ransom observe composed in Arabic via an SMS that urged a victim in Pakistan to make contact with them on Telegram.

“Rafel RAT is a powerful example of the evolving landscape of Android malware, characterised by its open-resource mother nature, in depth feature established, and prevalent utilization throughout many illicit pursuits,” Test Level mentioned.

“The prevalence of Rafel RAT highlights the need to have for continuous vigilance and proactive security actions to safeguard Android gadgets versus malicious exploitation.”

Identified this article appealing? Follow us on Twitter  and LinkedIn to go through additional unique content material we write-up.