Roaming Mantis

Also known as: Roaming Mantis, Roaming Mantis Group, Shaoye

According to new research by Kaspersky’s GReAT team, the online criminal activities of the Roaming Mantis Group have continued to evolve since they were first discovered in April 2018. As part of their activities, this group hacks into exploitable routers and changes their DNS configuration. This allows the attackers to redirect the router user’s traffic to malicious Android apps disguised as Facebook and Chrome or to Apple phishing pages that were used to steal Apple ID credentials. Recently, Kaspersky has discovered that this group is testing a new monetization scheme by redirecting iOS users to pages that contain the Coinhive in-browser mining script rather than the normal Apple phishing page. When users are redirected to these pages, they will be shown a blank page in the browser, but their CPU utilization will jump to 90% or higher.

🌍 Country ["[Unknown]"]

Associated Operations

2018-02 2018-05 2018-09 2019 to March 20 2019-02 2019-06 2019-08 2019. 2020-02 2020-06 2021 2021-01 2022 2022-07 According to our detection data In May In addition Ongoing Roaming Mantis smishing campaign targeting France Roaming Mantis Amplifies Smishing Campaign with OS-Specific Android Malware Roaming Mantis implements new DNS changer in its malicious mobile app in 2022 Roaming Mantis malware is designed for distribution through a simple Roaming Mantis reaches Europe Roaming Mantis: a new phishing method targets a Japanese MNO The McAfee mobile research team has found a new type of Android malware for the MoqHao phishing campaign (a.k.a. XLoader and Roaming Mantis) targeting Korean and Japanese users. A series of attack campaigns are still active The RoamingMantis Group’s Expansion to European Apple Accounts and Android Devices The group’s attack methods have improved and new targets continuously added in order to steal more funds. The attackers’ focus has also shifted to techniques that avoid tracking and research: whitelist for distribution aka MoqHao and XLoader analysis environment detection and so on. and an Apple phishing page for iOS devices. and crypto-mining capabilities for the PC. based on our KSN data from February 25 but very efficient trick based on a technique known as DNS hijacking. When a user attempts to access any website via a compromised router https://blog.sekoia.io/ongoing-roaming-mantis-smishing-campaign-targeting-france/ https://hackmd.io/@ninoseki/Bkw66OhAN https://medium.com/csis-techblog/the-roamingmantis-groups-expansion-to-european-apple-accounts-and-android-devices-e6381723c681 https://securelist.com/roaming-mantis-dabbles-in-mining-and-phishing-multilingually/85607/ https://securelist.com/roaming-mantis-dns-changer-in-malicious-mobile-app/108464/ https://securelist.com/roaming-mantis-part-3/88071/ https://securelist.com/roaming-mantis-part-iv/90332/ https://securelist.com/roaming-mantis-part-v/96250/ https://securelist.com/roaming-mantis-reaches-europe/105596/ https://securelist.com/roaming-mantis-uses-dns-hijacking-to-infect-android-smartphones/85178/ https://www.mcafee.com/blogs/other-blogs/mcafee-labs/moqhao-related-android-spyware-targeting-japan-and-korea-found-on-google-play/ https://www.mcafee.com/blogs/other-blogs/mcafee-labs/roaming-mantis-amplifies-smishing-campaign-with-os-specific-android-malware/ mainly targeting Japanese users. The new spyware has very different payloads from the existing MoqHao samples. new variants of sagawa.apk Type A (Trojan-Dropper.AndroidOS.Wroba.g) have been detected in the wild the criminals added a phishing option for iOS devices they have started using web crypto-mining for PC they will be redirected to a malicious website. we observed significant changes in their M.O. The group’s activity expanded geographically and they broadened their attack/evasion methods. Their landing pages and malicious apk files now support 27 languages covering Europe and the Middle East. In addition while monitoring Roaming Mantis

Introduction

According to new research by Kaspersky’s GReAT team, the online criminal activities of the Roaming Mantis Group have continued to evolve since they were first discovered in April 2018. As part of their activities, this group hacks into exploitable routers and changes their DNS configuration. This allows the attackers to redirect the router user’s traffic to malicious Android apps disguised as Facebook and Chrome or to Apple phishing pages that were used to steal Apple ID credentials. Recently, Kaspersky has discovered that this group is testing a new monetization scheme by redirecting iOS users to pages that contain the Coinhive in-browser mining script rather than the normal Apple phishing page. When users are redirected to these pages, they will be shown a blank page in the browser, but their CPU utilization will jump to 90% or higher.

Activities and Tactics

Country of Origin: 🏳️ [“[Unknown]”]

Notable Campaigns

  • 2018-02
  • 2018-05
  • 2018-09
  • 2019 to March 20
  • 2019-02
  • 2019-06
  • 2019-08
  • 2019.
  • 2020-02
  • 2020-06
  • 2021
  • 2021-01
  • 2022
  • 2022-07
  • According to our detection data
  • In May
  • In addition
  • Ongoing Roaming Mantis smishing campaign targeting France
  • Roaming Mantis Amplifies Smishing Campaign with OS-Specific Android Malware
  • Roaming Mantis implements new DNS changer in its malicious mobile app in 2022
  • Roaming Mantis malware is designed for distribution through a simple
  • Roaming Mantis reaches Europe
  • Roaming Mantis: a new phishing method targets a Japanese MNO
  • The McAfee mobile research team has found a new type of Android malware for the MoqHao phishing campaign (a.k.a. XLoader and Roaming Mantis) targeting Korean and Japanese users. A series of attack campaigns are still active
  • The RoamingMantis Group’s Expansion to European Apple Accounts and Android Devices
  • The group’s attack methods have improved and new targets continuously added in order to steal more funds. The attackers’ focus has also shifted to techniques that avoid tracking and research: whitelist for distribution
  • aka MoqHao and XLoader
  • analysis environment detection and so on.
  • and an Apple phishing page for iOS devices.
  • and crypto-mining capabilities for the PC.
  • based on our KSN data from February 25
  • but very efficient trick based on a technique known as DNS hijacking. When a user attempts to access any website via a compromised router
  • https://blog.sekoia.io/ongoing-roaming-mantis-smishing-campaign-targeting-france/
  • https://hackmd.io/@ninoseki/Bkw66OhAN
  • https://medium.com/csis-techblog/the-roamingmantis-groups-expansion-to-european-apple-accounts-and-android-devices-e6381723c681
  • https://securelist.com/roaming-mantis-dabbles-in-mining-and-phishing-multilingually/85607/
  • https://securelist.com/roaming-mantis-dns-changer-in-malicious-mobile-app/108464/
  • https://securelist.com/roaming-mantis-part-3/88071/
  • https://securelist.com/roaming-mantis-part-iv/90332/
  • https://securelist.com/roaming-mantis-part-v/96250/
  • https://securelist.com/roaming-mantis-reaches-europe/105596/
  • https://securelist.com/roaming-mantis-uses-dns-hijacking-to-infect-android-smartphones/85178/
  • https://www.mcafee.com/blogs/other-blogs/mcafee-labs/moqhao-related-android-spyware-targeting-japan-and-korea-found-on-google-play/
  • https://www.mcafee.com/blogs/other-blogs/mcafee-labs/roaming-mantis-amplifies-smishing-campaign-with-os-specific-android-malware/
  • mainly targeting Japanese users. The new spyware has very different payloads from the existing MoqHao samples.
  • new variants of sagawa.apk Type A (Trojan-Dropper.AndroidOS.Wroba.g) have been detected in the wild
  • the criminals added a phishing option for iOS devices
  • they have started using web crypto-mining for PC
  • they will be redirected to a malicious website.
  • we observed significant changes in their M.O. The group’s activity expanded geographically and they broadened their attack/evasion methods. Their landing pages and malicious apk files now support 27 languages covering Europe and the Middle East. In addition
  • while monitoring Roaming Mantis

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • DroidJack
  • Androrat
  • Chrome Remote Desktop
  • Xploit
  • malicious APK:
  • MITRE: S0509:
  • Wroba.o:
  • Roaming Mantis:
  • SmsSpy:

Attribution and Evidence

Country of Origin: [“[Unknown]”] Additional attribution information pending cataloguing.

References

References pending cataloguing.