Researchers at Check Point have recently released an analysis of “Rafel RAT” malware that has been observed targeting mobile devices running older versions of Android OS. Check Point observed approximately 120 Rafel Rat campaigns, some of which targeted high-profile organizations and the military, and most of which targeted victims in the United States, China, and Indonesia. Rafel RAT is capable of both stealing and encrypting data on the victim device. Its core commands for information stealing include sending the victim’s phonebook, SMS messages, device information, location, and file path information to the attacker’s command-and-control (C2) platform. Beyond stealing data, a variant of Rafel Rat has the capability to delete or encrypt files and lock the device screen. In these ransomware cases, the attacker will send the victim an SMS with the ransom note, instructing them to message the attacker on Telegram for negotiations. Rafel RAT could be spread via phishing, and researchers have seen the malware masquerading as known applications such as Instagram, WhatsApp, and antivirus applications to trick users into downloading the malware. It is believed that various threat actors are behind these recent campaigns. CTIX analysts recommend individuals keep operating systems up to date, never download applications from unknown sources, and to be cautious about what permissions are being granted to applications. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.