Octagon RAT Evades Android Reboots with Sophisticated Persistence
A new Android remote access trojan (RAT) named Octagon disguises itself as a fake emergency alert app, employing advanced techniques to survive device reboots and steal sensitive user data.
A sophisticated new Android remote access trojan (RAT), dubbed Octagon, has emerged, targeting users in Bahrain by impersonating the official BH Alert emergency notification service. This malware employs a multi-stage infection process and advanced persistence mechanisms designed to ensure its continued operation even after a device reboot, making it a significant threat to user privacy and security.
The campaign begins with the distribution of a malicious application, BH-Alert.apk, which masquerades as a legitimate emergency alert tool. To gain initial access and elevate its privileges, the app guides victims through a seven-step setup process. This initial application conceals its core malicious code within an encrypted file, only decrypting and loading it when necessary, a technique that helps it evade basic static analysis. Following this, it installs a secondary component, the OctagonPanel child application, and dynamically generates further malicious code.
Octagon's persistence capabilities are particularly noteworthy. It utilizes a combination of watchdog services and boot receivers. Watchdog processes are designed to monitor each other, ensuring that if one component is terminated, another can restart it. Furthermore, the use of boot receivers allows the malware to automatically re-initialize and resume its malicious activities whenever the Android operating system starts up. This makes traditional reboot-based remediation efforts largely ineffective against the Octagon RAT.
Adding to its resilience, Octagon creates a fake Android account named OctagonPanel and schedules synchronization tasks every 30 minutes. This routine can periodically wake the malware, ensuring it remains active and can reconnect with its command-and-control (C2) server. This constant connectivity helps maintain its configuration and ensures its removal resistance, complicating the process of thoroughly cleaning an infected device.
The RAT's capabilities extend to significant data exfiltration and control. Once active, Octagon prompts users to grant it Accessibility Service permissions and to set up a VPN connection. The Accessibility Service abuse allows the malware to log keystrokes, capturing sensitive information such as lock screen PINs, passwords, and patterns as they are entered. The deceptive VPN connection, rather than enhancing security, can be used to route the victim's internet traffic through an attacker-controlled tunnel, enabling traffic interception and redirection.
Beyond credential theft, Octagon is equipped to gather a wide array of sensitive data, including SMS messages, contact lists, call records, and screenshots. It can also display convincing phishing pages over legitimate applications, further deceiving users into divulging more information. The malware stores configuration data, phishing templates, and intercepted messages in a local SQLite database, allowing for continued data collection even during temporary network outages and later synchronization with the C2 server.
Security researchers emphasize that this campaign highlights the dangers of installing applications from unofficial sources and the importance of scrutinizing permission requests. Users are advised to download apps only from official app stores, verify developer information, keep their Android systems updated, and exercise extreme caution when an app requests sensitive permissions like Accessibility, VPN, or SMS access. Prompt removal of the BH Alert app from unofficial sources and changing critical credentials from a trusted device are recommended for anyone who may have fallen victim.
The sophisticated persistence techniques and broad data-stealing capabilities of the Octagon RAT underscore the evolving threat landscape for Android users. Its ability to evade detection and persist through reboots presents a significant challenge for mobile security, demanding increased user vigilance and robust security solutions.