MalwarePublished 6 Mar 2026Updated 9 Mar 2026

Mobile spyware campaign impersonates Israel's Red Alert rocket warning system

Source AlienVault OTX General

Description

A targeted campaign has been identified distributing a trojanized version of the Red Alert rocket warning Android app to Israeli users via SMS messages impersonating official Home Front Command communications. The malicious app retains full rocket alert functionality while running malicious code in the background. It bypasses Android security checks through certificate spoofing and runtime manipulation. Once installed, the malware collects sensitive data including SMS messages, contacts, location data, device accounts, and installed applications. The stolen data is transmitted to a remote command-and-control server. This campaign exploits user trust in emergency services during periods of geopolitical tension, combining social engineering with mobile espionage for maximum impact.

Impact

The impact of this spyware campaign is significant for Israeli individuals and organizations relying on the Red Alert app for life-saving rocket alerts. By compromising this trusted app, attackers gain access to a wealth of sensitive personal and device data, including communications, contacts, location, and device accounts, enabling extensive espionage and surveillance. This can lead to privacy violations, intelligence gathering, and potential targeting of individuals or groups. The malware’s ability to bypass Android security checks increases the likelihood of successful infection and persistence. Organizations with employees in Israel or those supporting Israeli operations may face indirect risks from compromised devices. The campaign undermines trust in critical emergency communication infrastructure, potentially causing users to hesitate in installing legitimate updates or apps. While currently focused on Israel, the techniques used could be adapted to other regions or apps, posing broader risks to mobile security and privacy worldwide.

Defensive guidance

To mitigate this threat, organizations and users should: 1) Only install apps from official app stores and verify app signatures carefully, especially for critical emergency apps; 2) Educate users about phishing SMS and social engineering tactics impersonating official entities, emphasizing caution with unsolicited links or app installations; 3) Employ mobile threat defense solutions capable of detecting certificate spoofing and runtime manipulation behaviors; 4) Monitor network traffic for communications to suspicious domains such as ra-backup.com and block them at network perimeters; 5) Implement mobile device management (MDM) policies enforcing app integrity checks and restricting installation of apps from unknown sources; 6) Encourage regular device and app updates to patch vulnerabilities; 7) Conduct threat hunting for indicators of compromise including the provided file hashes; 8) Collaborate with local cybersecurity authorities to share intelligence and receive timely alerts; 9) For critical personnel, consider using hardened or dedicated devices for emergency apps to reduce exposure; 10) Promote awareness campaigns during periods of geopolitical tension to reduce susceptibility to social engineering.

Indicators of compromise

Domains 2

ra-backup.com
api.ra-backup.com

URLs 2

https://api.ra-backup.com/analytics/submit.php
https://api.ra-backup.com/analytics/submit.php.

Hashes 3

9c6c67344fecd8ff8dbbee877aad7efc
04ee8594b5101505b92e14777466a62a2f4a2ceb
83651b0589665b112687f0858bfe2832ca317ba75e700c91ac34025ee6578b72

Community reviews

Loading reviews…