NEW!
Scope X
Scope in. Miss nothing.
Instantly magnify any part of your screen to reveal critical details in any game.
CypherRAT is a powerful Remote Access Trojan (RAT) designed for Android devices, developed and sold by a threat actor known as EVLF DEV (or simply EVLF).
Operating as a Malware-as-a-Service (MaaS), EVLF has provided these tools to over 100 different threat actors, allowing them to remotely control victim devices in real-time. In August 2023, the developer’s identity was publicly linked to a Syrian national, after which they announced the end of the project. Core Capabilities
The malware is designed to grant attackers complete surveillance and control over an infected device:
Real-time Monitoring: Attackers can remotely access and control the device's camera, microphone, and location.
Data Theft: It can exfiltrate sensitive personal data, including SMS messages, call logs, contacts, and files from external storage.
Financial Theft: Includes a clipboard hijacker that can replace copied cryptocurrency wallet addresses with an attacker's address, leading to stolen funds.
Social Media & Auth Theft: Capable of stealing Gmail and Facebook credentials, as well as Google 2FA codes. Malware Evasion & Persistence
According to research from firms like CYFIRMA and ThreatFabric, the malware uses several advanced techniques to remain hidden:
Anti-Uninstall ("Super Mod"): If a victim attempts to uninstall the malicious app, the malware can trigger a system crash to prevent removal.
Permission Abuse: It heavily misuses Accessibility Services to grant itself additional permissions and log keystrokes without user awareness. Cypher Rat Evlf
Obfuscation: The builder generates highly obfuscated APK packages to bypass security software and Google Play Protect. Distribution Methods CypherRAT is typically spread through:
Phishing Campaigns: Links in emails or SMS (smishing) leading to malicious downloads.
Deceptive Apps: Masquerading as legitimate software like WhatsApp, banking apps, or system updates on third-party stores.
Cracked Versions: Since the source code was leaked on forums and GitHub, many threat actors now use "cracked" or modified versions of the tool for free. Prevention and Removal To protect your device, security experts recommend:
Official Sources Only: Only download apps from the Google Play Store.
Security Software: Use reputable mobile antivirus like Combo Cleaner to scan for and remove infections.
Audit Permissions: Regularly check "Device admin apps" and "Accessibility" settings for any suspicious applications you don't recognize. EVLF DEV-The Creator of CypherRAT and CraxsRAT - cyfirma
CypherRAT is a highly potent Remote Access Trojan (RAT) designed specifically for the Android operating system, developed and monetized by a notorious threat actor known as EVLF DEV (or simply EVLF).
Operating on a highly profitable Malware-as-a-Service (MaaS) model, EVLF empowered lower-skilled cybercriminals by selling them advanced surveillance tools to target mobile users worldwide. 🎭 The Mastermind: Who is EVLF DEV? CypherRAT is a powerful Remote Access Trojan (RAT)
EVLF DEV is a cybercriminal developer traced by cybersecurity researchers to Syria.
The Operation: EVLF operated for over eight years, creating highly sophisticated Android malware including CypherRAT and its successor, CraxsRAT.
The Business Model: Operating primarily through the encrypted messaging app Telegram (via the channel "EvLF Devz"), EVLF provided cybercriminals with lifetime or monthly licenses for the malware.
The Exposure: In 2023, cybersecurity firm CYFIRMA unmasked the real-world identity of EVLF. They achieved this by following the digital breadcrumbs of a frozen cryptocurrency wallet used to collect MaaS profits. 🛠️ Key Features of CypherRAT
CypherRAT is considered particularly dangerous because it grants an external operator near-total control over an infected Android device.
Live Monitoring: The malware can stream the device's screen and activate both the front and back cameras in real-time.
Audio Surveillance: Operators can record ambient microphone input to eavesdrop on conversations.
Data Exfiltration: It effortlessly extracts personal file storage, precise GPS locations, full contact lists, call logs, and SMS messages.
Financial Theft: CypherRAT features a "clipboard hijacker". When a victim copies a cryptocurrency wallet address, the malware swaps it mid-operation with the attacker’s wallet address. Step 5: Consult threat intelligence
Keylogging: The malware records both online and offline keystrokes, capturing plain-text passwords and banking credentials.
Account Takeovers: It is engineered to intercept 2FA codes from Google and harvest login credentials for giants like Gmail and Facebook. 🏗️ How the Attack Works
The distribution and execution of CypherRAT rely on heavy obfuscation and psychological manipulation. 1. Delivery
Attackers rarely rely on compromised files alone. They typically trick victims into manually downloading the malware through: Phishing links sent via SMS or email Fake application downloads on third-party stores
Social engineering schemes posing as support agents or tech updates 2. The Builder EVLF DEV-The Creator of CypherRAT and CraxsRAT - cyfirma
Given that, I’ll provide a speculative write-up treating it as an alias or project name in a fictional or cyberpunk context.
Upon installation, the Evlf variant immediately requests the user to enable Accessibility Services. This is the core mechanism of the malware.
In a Capture The Flag (CTF) challenge, “Cypher Rat Evlf” could be:
cypher_rat_evlf.py – a tool that decrypts traffic from a RAT by XOR-ing with a rotating key derived from “Evlf.”It is not uncommon for new RAT families to use obscure naming conventions. If “Cypher Rat Evlf” were a real threat, it might denote an ELF-based (Linux) RAT with encryption features (“Cypher”) and a component named “Evlf.” However, major threat intelligence databases (VirusTotal, MITRE ATT&CK, AnyRun) show zero samples with this string. Therefore, it is not a recognized malware name.
Once installed, Cypher Rat typically requests extensive permissions (Accessibility Services, Admin rights). Once active, it allows the attacker to perform the following actions:
