New Spyware RatMilad Targets Middle Eastern Mobile Devices

RatMilad, a newly discovered Android spyware, has been stealing data from mobile devices in the Middle East.

The malware is spread through links on social media and pretends to be applications for services like VPN and phone number spoofing. Unwary users download these trojan applications and grant access to malware.

Loader Applications

Trojan apps named Text Me and NumRent were seen sideloading the RatMilad spyware. The two apps claim to help verify social media accounts. They are unavailable on legitimate application stores like Google Play but distributed on Telegram.

With more than 200 external shares, a post shared on a Telegram channel used to spread the malware sample has received over 4,700 views.

RatMilad loader apps (Source: Zimperium)

Capabilities of the Malware

RatMilad performs as sophisticated spyware on compromised devices. It can be used for espionage, extortion, and victim-eavesdropping, according to mobile security company Zimperium.

The capabilities of spyware include the ability to receive and execute commands to gather and exfiltrate data and carry out a wide range of malicious operations, like:

MAC Address of Device
Contact List
SMS List
Call Logs
Account Names and Permissions
Clipboard Data
GPS Location Data
Sim Information – Mobile number, Country, IMEI, Sim state
File list
Read, write, and Delete Files
Sound Recording
File upload to C&C
List of the installed applications, along with their permissions.
Set new application permissions.
Phone info – Model, Brand, buildID, android version, manufacturer

Who is Behind RatMilad?

Zimperium claims that RatMilad’s operators obtained the source code from the AppMilad hacker group in Iran and combined it with a fraudulent app to trick people into downloading it.

Although it’s uncertain how widespread the infections are, the cybersecurity firm claimed it found the spyware during an unsuccessful attempt to infiltrate a customer’s workplace device.

According to Richard Melick, head of mobile threat intelligence at Zimperium, the RatMilad spyware, and the Iranian-based hacking group AppMilad show a changing environment impacting mobile device security.

RatMilad is only one of many mobile spyware options, including Pegasus and PhoneSpy, accessible from both legitimate and illegitimate sources.