Security News > 2024 > June > Rafel RAT targets outdated Android phones in ransomware attacks
An open-source Android malware named 'Rafel RAT' is widely deployed by multiple cybercriminals to attack outdated devices, some aiming to lock them down with a ransomware module that demands payment on Telegram.
Researchers Antonis Terefos and Bohdan Melnykov at Check Point report detecting over 120 campaigns using the Rafel RAT malware.
This proves Rafel RAT is an effective attack tool against an array of different Android implementations.
The ransomware module in Rafel RAT is designed to execute extortion schemes by taking control of the victim's device and encrypting their files using a pre-defined AES key.
Check Point's researchers observed several ransomware operations involving Rafel RAT, including an attack from Iran that performed reconnaissance using Rafel RAT's other capabilities before running the encryption module.
Linux version of RansomHub ransomware targets VMware ESXi VMs. New Fog ransomware targets US education sector via breached VPNs. Over 90 malicious Android apps with 5.5M installs found on Google Play.
News URL
Related news
- Microsoft: Ransomware gangs exploit VMware ESXi auth bypass in attacks (source)
- Columbus investigates whether data was stolen in ransomware attack (source)
- Ransomware Attacks Are Attracting Record Payouts in Australia. Should You Pay the Ransom? (source)
- CISA warns of VMware ESXi bug exploited in ransomware attacks (source)
- OneBlood's virtual machines encrypted in ransomware attack (source)
- Surge in Magniber ransomware attacks impact home users worldwide (source)
- Keytronic reports losses of over $17 million after ransomware attack (source)
- Google fixes Android kernel zero-day exploited in targeted attacks (source)
- Ransomware gang targets IT workers with new RAT masquerading as IP scanner (source)
- UK health services call-handling vendor faces $7.7M fine over 2022 ransomware attack (source)