888 RAT Targets Kurd Groups, BladeHawk Hackers Run the Campaign
Kurdish ethnic groups are having their Android devices infected by what appears to be a new piece of Android malware. The threat, dubbed the 888 RAT, is used alongside SpyNote, another Remote Access Trojan (RAT) for Android. The criminals behind this attack appear to be a group tracked under the alias BladeHawk. These criminals have been involved in similar attacks in the past, where they used other Android implants. It is important to add that the 888 RAT may be referred under different names such as the LodaRAT or Gaza007 RAT.
How does this 888 RAT Campaign Reach Victims?
This particular campaign has been using fake Facebook profiles and other social media platforms to propagate the malicious app. The 888 RAT is usually masked as a legitimate piece of Android software, which the target downloads from a 3rd-party app-hosting site. The criminals use several profiles for the spam campaign. Some of these profiles pose as members of the tech community, while others act as Kurd supporters. Apart from promoting bogus apps delivering the 888 RAT, the same profiles were also used to spread phishing links for various social media apps and sites – such as Snapchat.
The 888 RAT is not a custom-built piece of malware. In fact, it was initially sold on a public website by its creators. It has been receiving regular updates, including An Android version that came out in 2019. It is not clear whether the BladeHawk hackers are using a purchased copy or a cracked one. Regardless, the features of the malware remain the same.
What are 888 RAT Capabilities?
The list of features of this Trojan is very rich. It is able to perform all sorts of tasks, and there is only one requirement – the victim must grant the app permissions to use the Android Accessibility Service. Since many people do not bother to actually check the privileges they grant apps, they may unknowingly give the 888 RAT full control over their Android device. Some of the most important tasks that this implant carries out include:
- Record calls.
- Grab screenshots.
- Receive hardware information about the device – GPS location, battery level, and more.
- Check for the presence of social media apps such as Facebook.
- Steal Facebook credentials.
- List all running apps.
- Manage the file system.
- Load URLs in hidden Web browser instances.
- Execute remote commands/scripts.
- Manage text messages.
Of course, all data that the 888 RAT extracts will be sent to the servers of the attackers. The implant is also able to display custom phishing overlays – probably made by the BladeHawk hackers.
Despite all of its dangerous features, the 888 RAT is a well-known piece of malware. Android users who invest in reputable and up-to-date antivirus apps can be certain that high-profile malware like this one will not get a chance to infect their device.
