Check Point · Published 12 Jan
Going Rogue- a Mastermind behind Android Malware Returns with a New RAT
By ramanl
Excerpt
Research by: Aviran Hazum, Alex Shamshur, Raman Ladutska, Ohad Mana, Israel Wernik
Introduction
Now more than ever, we rely on our smartphones to keep in touch with our work, our families and the world around us. There are over 3.5 billion smartphone users worldwide, and it is estimated that over 85% of those devices – around 3 billion – run the Android OS. Therefore, it is no surprise that criminals and threat actors are actively targeting this vast user base for their own malicious purposes, from trying to steal users’ data and cred…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Check Point on research.checkpoint.com.
Mentioned in the excerpt1
More from Check Point94
Check Point · Web page · Published 7 Mar
Pandas with a Soul: Chinese Espionage Attacks Against Southeast Asian Government Entities
In 2021, Check Point Research published a report on a previously undisclosed toolset used by Sharp Panda, a long-running Chinese cyber-espionage operation targeting Southeast Asian government entities. Since then, we have continued to track the use of these…
Check Point · Web page · Published 27 Mar
Rhadamanthys: The “Everything Bagel” Infostealer
Rhadamanthys is an advanced infostealer which debuted on the dark web in September of last year to a warm critical reception by cybercriminals. A maximalist approach to features: functionality is added for its own sake, never mind the effort required or…
Check Point · Web page · Published 10 Dec
Cracking ValleyRAT: From Builder Secrets to Kernel Rootkits
Check Point Research (CPR) presents a full dissection of the widely used ValleyRAT backdoor, also known as Winos/Winos4.0, covering its modular architecture and plugin system. By analyzing the publicly leaked builder and development structure (Visual Studio…
Check Point · Web page · Published 10 Apr
Threat Actors Migrating to the Cloud
Where do malware payloads come from? It’s a question with an apparently trivial answer. Usually these sit on dedicated servers owned by the campaign managers, and occasionally on a legitimate website that has been broken into and commandeered. But, as we were…
On the same topics
ETDA Threat Group Cards · Web page · Added 25 Oct
Threat Group Cards: A Threat Actor Encyclopedia
Home > List all groups > List all tools > List all groups using tool Retefe (Android) Tool: Retefe (Android) Names Retefe (Android) Category Malware Type Banking trojan, Backdoor, Info stealer, Credential stealer, Botnet (GovCERT.ch) Recently, some anti-virus…
ESET · Web page · Added 10 Jun
A rigged game: ScarCruft compromises gaming platform in a supply-chain attack
ESET researchers uncovered a multiplatform supply-chain attack by North Korea-aligned APT group ScarCruft, targeting the Yanbian region in China – home to ethnic Koreans and a crossing point for North Korean refugees and defectors. In the attack, probably…
ThreatFabric · Web page · Published 1 Oct
New TrickMo Variant: Device Take Over malware targeting Banking, Fintech, Wallet & Auth apps
Modern Android banking malware increasingly evolves through architectural redesigns intended to improve stealth, resilience, and operational flexibility rather than through entirely new user-facing capabilities. As platform protections and detection measures…