Ransomware/Malware Activity
Rafel RAT Android Malware Deployed for Espionage and
Ransomware
Researchers at Check Point have recently released an analysis of
“Rafel RAT” malware that has been observed targeting
mobile devices running older versions of Android OS. Check Point
observed approximately 120 Rafel Rat campaigns, some of which
targeted high-profile organizations and the military, and most of
which targeted victims in the United States, China, and Indonesia.
Rafel RAT is capable of both stealing and encrypting data on the
victim device. Its core commands for information stealing include
sending the victim's phonebook, SMS messages, device
information, location, and file path information to the
attacker's command-and-control (C2) platform. Beyond stealing
data, a variant of Rafel Rat has the capability to delete or
encrypt files and lock the device screen. In these ransomware
cases, the attacker will send the victim an SMS with the ransom
note, instructing
