Ratel RAT targets outdated Android phones in ransomware attacks

Check Point researchers analyzed the widespread Android malware Rafel RAT, used in more than 120 campaigns to target primarily end-of-life Android devices (≤ Android 11). Operators distribute fake APKs impersonating legitimate apps, request risky permissions to persist, and remotely execute commands including file encryption (ransomware), device locking, wiping, SMS/2FA exfiltration, and live location tracking; roughly 10% of observed infections triggered the ransomware command. The activity has targeted high-profile organizations including government and military entities across the US, China, and Indonesia, and involves both known APTs (e.g., APT-C-35) and criminal groups.