Why Android Users Should Beware of CraxsRAT Mobile Malware
Android users need to exercise caution as a new mobile malware threat known as CraxsRAT has been identified, raising serious concerns about their digital security. The uncovering of the developer's true identity behind this malware sheds light on the extent and sophistication of this threat.
Cybersecurity firm Cyfirma has conducted an investigation that led to the revelation of the developer's identity, who operates under the online alias 'EVLF DEV' and has been active in Syria for the past eight years. This individual has been responsible for creating and selling two remote access trojans (RATs) named CypherRAT and CraxsRAT, raking in more than $75,000 by selling these malicious tools to various threat actors. Additionally, Cyfirma has identified 'EVLF DEV' as a malware-as-a-service (MaaS) operator, which suggests a broader and more organized cybercriminal operation.
What does raxsRAT Mobile Malware do?
What makes CraxsRAT particularly alarming is its accessibility and adaptability for malicious purposes. 'EVLF DEV' has been marketing CraxsRAT for the past three years on a surface web store, where it has sold at least 100 lifetime licenses. This Android RAT offers a range of dangerous capabilities, including the generation of highly obfuscated packages that enable threat actors to tailor their attacks, even employing WebView page injections.
Moreover, the CraxsRAT builder includes a "quick install" feature designed to produce applications with minimal install permissions, making it more challenging for security systems to detect. After installation, however, the malware allows threat actors to request additional permissions, including accessibility settings, which are crucial for gaining access to a device's screen and keystrokes. This flexibility enables attackers to manipulate the post-installation process, further enhancing their control over the compromised device.
CraxsRAT goes to great lengths to make itself difficult to remove from infected devices. Its 'super mod' feature intentionally crashes the device whenever an attempt to uninstall the application is detected. This persistence poses a significant challenge for users attempting to rid their devices of this malware.
Once CraxsRAT infiltrates a device, it has the capacity to extract a wealth of sensitive information. This includes the ability to access the device's precise location, read and steal contact information, gain access to the device's storage, and read messages and call logs. These capabilities can result in severe privacy breaches and potential financial or identity theft for unsuspecting Android users.
Cyfirma's investigation into 'EVLF DEV's' activities led to the discovery of a Telegram channel boasting over 10,000 subscribers. Additionally, a cryptocurrency wallet associated with the malware developer revealed substantial earnings from selling RATs over a period of at least three years. Cyfirma took proactive steps by contacting the cryptocurrency wallet company, leading to a freeze of the threat actor's assets pending identity verification.
What should Android users do when encountering raxsRAT Mobile Malware?
As a result of these actions, 'EVLF DEV' resorted to a crypto discussion forum to discuss their predicament, inadvertently providing Cyfirma with further insight into the adversary's identity, including their real name, various usernames, IP address, and email address. These discoveries represent significant progress in identifying and combatting this dangerous cyber threat.
In light of these findings, Android users are advised to remain vigilant and take appropriate precautions to protect their devices from the CraxsRAT malware. This includes regularly updating their devices and applications, avoiding suspicious downloads, and utilizing reputable antivirus software to detect and remove potential threats. Additionally, staying informed about emerging cybersecurity threats and their potential implications is essential in safeguarding personal data and privacy in an increasingly digital world.
