ReboundRAT
How Lookout Detects and Protects
To ensure protection against Remote Access Trojan (RAT) attacks like ReboundRAT, Lookout Mobile Endpoint Security leverages security telemetry from over 100 million analyzed applications. With this visibility into malicious applications, Lookout extends the latest protections without any action needed from the end user. To protect against social engineering as one of the fastest-growing threat vectors, Lookout Phishing Protection can block the connection to malicious links and stop attacks before they start.
Overview
Israeli Defense Forces (IDF) announced that it was targeted by ReboundRAT - a very targeted and socially engineered Remote Access Trojan (RAT) malware campaign. Similar to ViperRAT, which Lookout discovered in 2017, this campaign baits soldiers into downloading a fake dating app by messaging them on social media platforms under the ruse of being an attractive young woman.
Lookout Analysis
The campaign was discovered and taken down by the IDF in conjunction with the Israeli Security Agency (ISA). Even though this particular campaign targeted the IDF, it shows how malicious actors are going beyond email to take a personalized approach to targeting specific groups or individuals. Lookout continuously discovers and provides coverage for attacks like ReboundRAT including ViperRAT, BRATA, HeroRAT, TeleRAT, and AndroRAT, which were delivered in a variety of ways to the end user.
The nature of this attack highlights how mobile users are increasingly becoming a core focus of cybersecurity attacks. Targeting the military, specifically individuals whose location data and communication have significant value to adversaries, can be detrimental to the national security of any targeted nation. Leveraging social engineering is becoming a more popular way for bad actors to persuade end users to fall for phishing links and download malicious apps. Without tools in place to protect its end users, an organization or nation state’s security is only as good as its least alert people.
Authors
Lookout
Lookout is a cybersecurity company that makes it possible for tens of millions of individuals, enterprises and government agencies to be both mobile and secure. Powered by a dataset of virtually all the mobile code in the world -- 40 million apps and counting -- the Lookout Security Cloud can identify connections that would otherwise go unseen and predict and stop mobile attacks before they do harm. The world’s leading mobile network operators, including AT&T, Deutsche Telekom, EE, KDDI, Orange, Sprint, T-Mobile and Telstra, have selected Lookout as its preferred mobile security solution. Lookout is also partnered with such enterprise leaders as AirWatch, Ingram Micro, Microsoft, and MobileIron. Headquartered in San Francisco, Lookout has offices in Amsterdam, Boston, London, Sydney, Tokyo, Toronto and Washington, D.C.
.png)
