- Jul 27, 2015
Attackers have been using a new spyware against enterprise Android devices, dubbed RatMilad and disguised as a helpful app to get around some countries' Internet restrictions.
For now, the campaign is operating in the Middle East in a broad effort to gather victims' personal and corporate information, according to researchers from Zimperium zLabs. The original version of RatMilad hid behind a VPN- and phone-number-spoofing app called Text Me, researchers revealed in a blog post published Wednesday. The app's function is purportedly to enable a user to verify a social media account through his or her phone — "a common technique used by social media users in countries where access might be restricted or that might want a second, verified account," Zimperium zLabs researcher Nipun Gupta wrote in the post.
More recently, however, researchers discovered a live sample of the RatMilad spyware being distributed through NumRent, a renamed and graphically updated version of Text Me, via a Telegram channel, he said. Its developers also have created a product website for advertising and distributing the app, to try to fool victims into believing it is legitimate.
Once deployed, RatMilad accesses like an advanced remote access Trojan (RAT) that receives and executes commands to collect and exfiltrate a variety of data and perform a range of malicious actions, researchers said.
"Similar to other mobile spyware we have seen, the data stolen from these devices could be used to access private corporate systems, blackmail a victim, and more," Gupta wrote. "The malicious actors could then produce notes on the victim, download any stolen materials, and gather intelligence for other nefarious practices." From an operational perspective, RatMilad performs various requests to a command-and-control server based on certain jobID and requestType, and then dwells and lies in wait indefinitely for the various tasks it can perform to execute on the device, researchers said. Ironically, researchers initially noticed the spyware when it failed to infect a customer's enterprise device.
RatMilad Spyware Scurries onto Enterprise Android Phones
A novel mobile malware found lurking behind a phone-spoofing app is being distributed via Telegram and a dedicated website, in a broad operation to monitor corporate victims.