McAfee discovered an instance of El Gato running on a compromised server, but noted that it appeared inert — it wasn’t password protected, and “included code words such as MyDifficultPassw.”
Unlike the pictured kitty, El Gato is anything but cute and cuddly. The malicious software is a form of ransomware, code that renders a device unusable until the victim forks over money. This one is particularly sophisticated, from the sound of it — El Gato can encrypt files, steal text messages, and even “block access” to the affected handset or tablet entirely.
El Gato accomplishes most of its nasty shenanigans remotely, via a connection with an offshore server. It constantly monitors an infected device’s internet connection for commands and, once it receives them, executes on them. Among the most common functions McAfee’s researchers discovered were sending messages from the infected device, forwarding and deleting text messages, locking the device’s screen, and crashing a specific application. Worryingly, it’s capable of performing many of those tasks clandestinely, in the background, making them effectively invisible to victims.
Most of El Gato’s commands are dispatched through a surprisingly polished web-based interface, said McAfee. They can be executed in sequence or individually — stealing a text message, frighteningly, is as easy as clicking a button in a web browser.
Perhaps worse yet, El Gato is capable of encrypting all files on the device’s internal storage — rendering it essentially unusable without the randomly generated password it generates. It contains a means of reversing the damage — the malware has can decrypt any file it secures — but presumably only after an affected user hands over whatever form of payment the attacker demands.
There’s good news, though: as far as malware goes, El Gato is relatively harmless. It hasn’t been observed in the wild yet, and its traffic is entirely unencrypted, making it susceptible to countermeasures. In other words, El Gato’s commands could be intercepted, isolated, and rendered harmless.
El Gato may be the latest instance of ransomware to emerge on Android, but it’s hardly the first. In May, cybersecurity analysts at Malwarebytes Labs discovered Cyber.Police, a malicious app that displayed a countdown timer, threatening message, and an explicit pornographic image to victims. It demanded that users purchase iTunes gift cards in exchange for an unlock code — a component which El Gato thankfully lacks, as of yet.
