888 RAT

Damage potential: Data theft, remote control and surveillance, espionage

Overview

888 RAT, also known as LodaRAT and Gaza007, is a remote access trojan primarily targeting Android devices. It allows cybercriminals to control an infected device, gather device and system data, monitor phone calls and text messages, extract contacts list, take screenshots, record video or audio, download files, and steal credentials for social media accounts. 888 RAT first emerged in 2018 and has been used in cyber espionage.

Possible symptoms

Signs of an 888 RAT infection are often related to remote control and monitoring of the compromised device, such as:

• Frequent crashes.

• Applications running slowly.

• Unfamiliar files or programs.

• Changes in system settings.

• Suspicious network activity.

• Increased data and battery usage.

• An excessive amount of pop-ups, ads, and redirects.

• Microphone, camera, or webcam turning on and off unexpectedly.

• Antivirus or other security software being deactivated without user interaction.

Sources of the infection

Malicious attachments and links in spam emails, drive-by downloads, freeware websites, peer-to-peer sharing of infected files, and unofficial software activation tools are the most typical sources of infection for this remote access trojan.

Protection

Good cybersecurity habits are essential for protecting yourself online.

• Do not click on suspicious links or attachments in emails, especially from unknown senders.

• Avoid downloading files or software from unofficial sources.

• Scan downloads for malware, block malware-hosting websites, and stop ads with NordVPN’s Threat Protection feature.

• Install reliable antivirus software and keep it updated.