When it comes to mobile devices, Android is the most popular and used operating system with over 3.9 billion active users in over 190 countries. Three-quarters of all mobile devices run on Android. However, with its widespread adoption and open environment comes the risk of malicious activity. Android malware, a malicious software designed to target Android devices, poses a significant threat to users’ privacy, security, and data integrity. These malicious programs come in various forms, including viruses, Trojans, ransomware, spyware, and adware, and they can infiltrate devices through multiple vectors, such as app downloads, malicious websites, phishing attacks, and even system vulnerabilities.
Check Point Research (CPR) has identified multiple threat actors utilizing Rafel, an open-source remote administration tool (RAT). The discovery of an espionage group leveraging Rafel in their operations was of particular significance, as it indicates the tool’s efficacy across various threat actor profiles and operational objectives.
In an earlier publication, we identified APT-C-35 / DoNot Team utilizing Rafel RAT. Rafel’s features and capabilities, such as remote access, surveillance, data exfiltration, and persistence mechanisms, make it a potent tool for conducting covert operations and infiltrating high-value targets.
CPR collected multiple malware samples from this Android RAT, and around 120 command and control servers. Further on, we conducted victims’ analysis and found that the most targeted countries were the United States of America, China, and Indonesia.
Figure 1 – Infected devices per country
The majority of victims had Samsung phones, with Xiaomi, Vivo, and Huawei users comprising the second-largest group among the targeted victims. This result corresponds to the popularity of the devices in various markets.
Figure 2 – Victims Devices
It is intriguing to note the distribution of Android versions among the most affected victims. Android 11 is the most prevalent, followed by versions 8 and 5. Despite the variety of Android versions, malware can generally operate across all. However, newer versions of the operating system typically present more challenges for malware to execute its functions or require more actions from the victim to be effective.
Figure 3 – Android Versions
One thing we constantly observe in Windows bots is the consistently high number of Windows XP infections, despite the fact that this version reached its End of Life in 2014. We observed the same scenario in infected Android devices. More than 87% of the affected victims are running Android versions that are no longer supported and, consequently, not receiving security fixes.
Furthermore, CPR analyzed three specific cases in depth. The first was an Android ransomware operation in which the threat actor encrypted the device’s files. The second was leaked Two-Factor Authentication messages (2FA) which could possibly lead to 2FA bypass, and the last case was a threat actor installing Rafel command and control on a hacked government website and infected devices reporting to it.
Figure 4 – Rafel RAT is hosted on Pakistan’s government website
Rafel RAT is a potent example of the evolving landscape of Android malware, characterized by its open-source nature, extensive feature set, and widespread utilization across various illicit activities. The prevalence of Rafel RAT highlights the need for continual vigilance and proactive security measures to safeguard Android devices against malicious exploitation. As cyber criminals continue to leverage techniques and tools such as Rafel RAT to compromise user privacy, steal sensitive data, and perpetrate financial fraud, a multi-layered approach to mobile security is essential.
Steps Android Users Need to take to stay safe:
- Install Apps from Trusted Sources: Only download and install apps from reputable sources like the Google Play Store. Avoid third-party app stores and be cautious with apps that have few downloads or poor reviews. Always check app permissions and reviews before installing.
- Keep Your Software Updated: Regularly update your Android operating system and apps. Updates often include security patches that protect against newly discovered vulnerabilities. Enable automatic updates to ensure you receive the latest protections without delay.
- Use a Reliable Mobile Security App: Install a reputable mobile security app that offers real-time protection against malware. These apps can scan for malicious software, detect suspicious activity, and provide additional security features like anti-theft measures and safe browsing.
By following the steps listed above, Android users can significantly reduce their risk of encountering malware and enhance their device security.
Check Point’s Harmony Mobile prevents malware from infiltrating mobile devices by detecting and blocking the download of malicious apps in real time. Harmony Mobile’s unique network security infrastructure—on—device Network Protection—allows you to stay ahead of emerging threats by extending Check Point’s industry-leading network security technologies to mobile devices.