Mobile RAT for Android Offered on Darknet Forums

mood · Jan 14, 2021

Mobile RAT for Android Offered on Darknet Forums
Researchers: 'Rogue' Steals Data, Delivers Other Malware
January 13, 2021
https://www.databreachtoday.com/mobile-rat-for-android-offered-on-darknet-forums-a-15753

A recently identified mobile remote access Trojan dubbed "Rogue," which exploits Google's Firebase development platform, targets Android devices to exfiltrate personal data and can deliver other malware, according to the security firm Check Point Research.

The Rogue RAT is being offered for sale or rent in darknet forums, Check Point says in its new report. Once a hacker uses the Trojan, portrayed to victims as a legitimate app, to infect a device, the malware can exfiltrate data, such as photos, location information, contacts and messages. It also can download additional malicious payloads, including mobile ransomware.

"When Rogue successfully gains all of the required permissions on the targeted device, it hides its icon from the device's user to ensure it will not be easy to get rid of it. If all of the required permissions are not granted, it will repeatedly ask the user to grant them," the Check Point report notes. "If the user tries to revoke the admin permission, an onscreen message designed to strike terror in the heart of the user appears: 'Are you sure to wipe all the data?'"
Click to expand...

Abusing Firebase
The report notes the Rogue RAT uses Google's Firebase platform to target and compromise as many Android devices as possible. Firebase, supported by Google Cloud Platform, is designed to help developers scale their applications.
Malware Authors
Check Point Research says Rogue was designed by a darknet developer called "Triangulum," who developed the Trojan by collaborating with another threat actor named "HexaGoN Dev" who specializes in Android operating system malware.
Click to expand...

The Check Point researchers note that Triangulum appears to have used source code from two other Android RATs, called Cosmos and Hawkshaw, to create the Rogue malware.
Click to expand...

Check Point Research: Going Rogue- a Mastermind behind Android Malware Returns with a New RAT

Check Point Research (CPR) recently encountered a mastermind’s network of Android mobile malware development on the dark net. This discovery piqued our interest, as it was extraordinary, even by dark net standards. CPR researchers decided to dig deeper to learn more about the threat actor behind the network, his products, and the business model behind malicious targeting of Android mobile devices.
Click to expand...

Log in or Sign up

Mobile RAT for Android Offered on Darknet Forums

mood Updates Team

Log in or Sign up

Mobile RAT for Android Offered on Darknet Forums

mood Updates Team

Useful Searches