Roaming Mantis uses DNS hijacking to infect Android smartphones

Minimalist · Apr 16, 2018

In March 2018, Japanese media reported the hijacking of DNS settings on routers located in Japan, redirecting users to malicious IP addresses. The redirection led to the installation of Trojanized applications named facebook.apk and chrome.apk that contained Android Trojan-Banker. According to our telemetry data, this malware was detected more than 6,000 times, though the reports came from just 150 unique users (from February 9 to April 9, 2018). Of course, this is down to the nature of the malware distribution, but it also suggests a very painful experience for some users, who saw the same malware appear again and again in their network. More than half of the detections were observed targeting the Asian region.
Click to expand...

https://securelist.com/roaming-mantis-uses-dns-hijacking-to-infect-android-smartphones

guest · May 21, 2018

'Roaming Mantis' Android Malware Evolves, Expands Targets
May 21, 2018
https://www.darkreading.com/endpoin...alware-evolves-expands-targets/d/d-id/1331850

The trend of malware that evolves and adapts continues with the so-called Roaming Mantis malware targeting Android devices, which has broadened both its geographic range and its functional scope.

In its new form, it's ticking off boxes for almost all the most popular malware trends.

In less than a month, Roaming Mantis has broadened its capabilities and enhanced its evasion techniques. It shows all the signs of being the product of a well-funded professional malware development organization, which adds weight to the tick mark in the final check box.
Click to expand...

guest · Oct 1, 2018

Roaming Mantis part III: iOS crypto-mining and spreading via malicious content delivery system
October 1, 2018
https://securelist.com/roaming-mantis-part-3/88071/

We have confirmed several new activities and changes to their illegal profit-gaining methods such as web crypto mining for iOS devices, spreading via malicious content delivery system and so on. This blogpost reveals some details of our new findings related to Roaming Mantis, based on our research.
Conclusions
It seems that the attack doesn’t stop developing. In our recent research, we found that they probed using a web miner for iOS, instead of redirecting to a fake Apple website.

Another new method they applied is the use of a malware delivery eco-system that is probably operated by a third party and was used to spread other (maybe even unrelated) malware in the past. The infection vector in that case was an SMS message with a malicious link that led a user to a fake web site that offered a download of the malicious apk file “sagawa.apk”

Roaming Mantis is also trying to spread its malware via prezi.com, with a scam that offers a visitor free content such as videos and more.
Click to expand...

guest · Apr 4, 2019

Roaming Mantis, part IV
Mobile config for Apple phishing, and re-spreading an updated malicious APK (MoqHao/XLoader)
April 3, 2019
https://securelist.com/roaming-mantis-part-iv/90332/

One year has passed since we published the first blogpost about the Roaming Mantis campaign on securelist.com, and this February we detected new activities by the group. This blogpost is follow up on our earlier reporting about the group with updates on their tools and tactics.
Mobile config for Apple phishing
Our key finding is that the actor continues to seek ways to compromise iOS devices and has even built a new landing page for iOS users. When an iPhone user visits this landing page, she sees pop-up messages guiding her to the malicious iOS mobile config installation: [...]
Conclusion
We have seen increased distribution of sagawa.apk Type A since late February 2019. This wave is characterized by a new attack method of phishing with malicious mobile config, although the previously observed DNS manipulation is also still actively used. We find the use of malicious mobile config especially alarming as this may cause serious problems for the users.
Click to expand...

guest · Feb 27, 2020

Roaming Mantis, part V
Distributed in 2019 using SMiShing and enhanced anti-researcher techniques
February 27, 2020
https://securelist.com/roaming-mantis-part-v/96250/

Kaspersky has continued to track the Roaming Mantis campaign. The group’s attack methods have improved and new targets continuously added in order to steal more funds. The attackers’ focus has also shifted to techniques that avoid tracking and research: whitelist for distribution, analysis environment detection and so on. We’ve also observed new malware families: Fakecop (also known as SpyAgent by McAfee) and Wroba.j (also known as Funkybot by Fortinet).
Distribution of Wroba.g via SMiShing with impersonated brands
In 2018, the group added a distribution method for Wroba.g (aliases: Moqhao and XLoader), in addition to the original method of DNS hijacking. It was SMiShing using a spoofed delivery notice from a logistics company. [...]
Multidex obfuscation trick in a loader module of Wroba.g
In 2019, the actor used Multidex in an APK file to hide a malicious loader module as an obfuscation trick. [...]
Click to expand...

Conclusion
The Roaming Mantis actor is strongly motivated by financial gain and is eager to evade tracking by researchers. It is now employing yet another method – whitelisting – to achieve this. This new method is currently only being applied for Korean pages, but it’s only a matter of time before it’s implemented for other languages.

The actor is still very active in using SMiShing for Android malware distribution. This is particularly alarming, because it means all infected mobile devices could form a botnet for malware delivery, SMiShing, and so on. ISPs, together with security companies, need to keep a close eye on the Roaming Mantis campaign to understand how to combat it.
Click to expand...

Log in or Sign up

Roaming Mantis uses DNS hijacking to infect Android smartphones

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Roaming Mantis uses DNS hijacking to infect Android smartphones

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches