Security News > 2024 > June > Rafel RAT targets outdated Android phones in ransomware attacks
An open-source Android malware named 'Rafel RAT' is widely deployed by multiple cybercriminals to attack outdated devices, some aiming to lock them down with a ransomware module that demands payment on Telegram.
Researchers Antonis Terefos and Bohdan Melnykov at Check Point report detecting over 120 campaigns using the Rafel RAT malware.
This proves Rafel RAT is an effective attack tool against an array of different Android implementations.
The ransomware module in Rafel RAT is designed to execute extortion schemes by taking control of the victim's device and encrypting their files using a pre-defined AES key.
Check Point's researchers observed several ransomware operations involving Rafel RAT, including an attack from Iran that performed reconnaissance using Rafel RAT's other capabilities before running the encryption module.
Linux version of RansomHub ransomware targets VMware ESXi VMs. New Fog ransomware targets US education sector via breached VPNs. Over 90 malicious Android apps with 5.5M installs found on Google Play.
News URL
Related news
- Google fixes Android zero-days exploited in attacks, 60 other flaws (source)
- Sensata Technologies hit by ransomware attack impacting operations (source)
- iOS devices face twice the phishing attacks of Android (source)
- Ransomware attack cost IKEA operator in Eastern Europe $23 million (source)
- Kidney dialysis firm DaVita hit by weekend ransomware attack (source)
- Chinese Android Phones Shipped with Fake WhatsApp, Telegram Apps Targeting Crypto Users (source)
- Ahold Delhaize confirms data theft after INC ransomware claims attack (source)
- Interlock ransomware gang pushes fake IT tools in ClickFix attacks (source)
- New Android malware steals your credit cards for NFC relay attacks (source)
- SuperCard X Android Malware Enables Contactless ATM and PoS Fraud via NFC Relay Attacks (source)