Kaspersky researchers have discovered a new malicious Android remote access tool (RAT) called BRATA . The hackers behind BRATA are trying to infect victims’ devices via WhatsApp and SMS messages . The hackers’ goal is to spy on users from Brazil .
The new RAT was discovered by Kaspersky researchers in January.
So far, researchers have discovered more than 20 variants of BRATA in apps . However, some of the variants were found in apps on unofficial Android app stores.
Hackers use various methods to infect victims' devices. They send various notifications via compromised sites, as well as messages via WhatsApp or SMS.
However, according to researchers, most BRATA variants are presented as updates to the popular WhatsApp application.
Once downloaded, the fake updates exploit CVE-2019-3568 and infect Brazilian users' Android devices.
How does BRATA work?
Once BRATA RAT infects the device, it will activate its keylogging. In addition, it interacts with other applications installed on the user's device.
Hackers can do many things through BRATA. For example, they can unlock devices , steal information about the device, turn off the screen, and perform various tasks in secret. In the end, the RAT removes itself from the device, eliminating any traces of the infection.
RATs are being used very frequently by hackers this month
Attackers have used a lot of RATs this month. Many government and financial services have been hit with Revenge and Orcus Remote Access Trojans.
Last week hackers used the Adwind RAT (also known as jRAT, AlienSpy, JSocket, and Sockrat) to attack utility industries.
Many services from the Balkans were also attacked by a combination of backdoor and RAT, known as BalkanDoor and BalkanRAT.
A few days ago, researchers detected a new RAT malware called LookBack, which was spreading through a spear-phishing campaign and targeting employees of American companies.
