Roaming Mantis mobile smishing campaign spreads, gets updated features


First spotted targeting APAC countries in 2018, Roaming Mantis recently received updates allowing it to steal more data and has begun targeting individuals in France and Germany.

Image: Adobe Stock/Backcountry Media

The mobile malware campaign known as Roaming Mantis largely left the news cycle after making a splash in 2018, but Kaspersky is reporting that some new life has been breathed into the campaign in the form of new features and new targets: This time it’s set its sights on France and Germany.

Roaming Mantis is a mobile device smishing (text message phishing) campaign that uses several different Android trojans (Wroba.g, Wroba.o, Moqhao and XLoader) to take control of Android devices. iOS users aren’t off the hook, though: When a Roaming Mantis sms link is tapped, it can detect the type of device and region, and when it finds an iOS device it directs the victim to a fake Apple ID login page in the language of their respective country.

When it first appeared in 2018, Kaspersky said Roaming Mantis was found targeting mobile device users in Japan, Taiwan and Korea. As of July 2021, Kaspersky said the malware dropper used by Roaming Mantis has been found in France, Japan, India, China, Germany and Korea, in descending order.

That’s not great news: Roaming Mantis has the potential to seize nearly total control of an infected device.

How Roaming Mantis infects a device

As mentioned above, Roaming Mantis spreads through phishing text messages that Kaspersky said contain a short description and an obfuscated link. In both examples of smishing messages sent to France and Germany, the description was about package tracking; a common tactic cybercriminals use to lure victims.

SEE: Password breach: Why pop culture and passwords don’t mix (free PDF) (TechRepublic)

When the link is clicked, Android users are met with a prompt to download something, which is the Roaming Mantis malware dropper. Once installed, the Roaming Mantis malware is able to do a variety of things to the infected device: Send text messages, ping the device, read the state of the phone, forward calls, lock the device, and two new ones Kaspersky detected as part of the 2021 updates and targeting changes: Stealing individual photos or entire galleries.

Kaspersky said that the new features, in particular, point to Roaming Mantis’ developers having two aims in mind. First, to steal photographs of various forms of ID, like driver’s licenses, health insurance cards and other important documents that we often scan to send to employers for COVID testing and the like. Kaspersky said this info is likely to be used for signing up for contracts or payment services in the victim’s name. The second likely use Kaspersy mentioned is to blackmail users who may have private or incriminating photos on their device.

Why Roaming Mantis is so dangerous

As Roaming Mantis has spread to different countries with different languages, it’s continued to add new region checks to its system, which in turn added pages in French, German and other languages used in countries it targets.

In addition to its ability to change to suit its environment, Roaming Mantis also uses several different obfuscation techniques on its landing pages to avoid detection, as well as undermine researchers attempting to understand its code. “In addition to obfuscation, the landing page blocks the connection from the source IP address in non-targeted regions and shows just a fake ‘404’ page for these connections,” Kaspersky said.

It’s not only France and Germany where Roaming Mantis has spread, either. Kaspersky cited independent research published by Japanese security expert @ninoseki that shows it also being active in the United States, India, Taiwan and Turkey, though in no way near to the total infection numbers in France and Japan, from which ninoseki detected 66,789 and 22,254 downloads on one day in September 2021, respectively. Regardless of the high level of Japanese detections, Kaspersky said that it believes France and Germany are now Roaming Mantis’ top targets.

Like all phishing-related attacks, Roaming Mantis requires action on the user’s part. Specifically when the phishing link is followed, the user has to OK the download and installation, and it’s there that the biggest security takeaway from this story appears.

SEE: Google Chrome: Security and UI tips you need to know (TechRepublic Premium)

Those using Android devices should never install apps from unknown sources. Android has app-level controls that can prevent web browsers from installing anything, though the best practice is to ensure you can’t install apps from anywhere but the Google Play store. Unfortunately, Android devices differ greatly in where this setting is found. Check with your manufacturer or carrier for particular steps.

Companies that issue Android devices for employees should nip unauthorized apps in the bud by disabling app installations from unknown sources at the MDM level.

Additionally, be sure you and your users know what phishing is, and how to spot phishing attacks coming from emails, social media, texts or in any other format.

 



Source link

istanbul escort aksaray escort arnavutköy escort ataköy escort avcılar escort avcılar türbanlı escort avrupa yakası escort bağcılar escort bahçelievler escort bahçeşehir escort bakırköy escort başakşehir escort bayrampaşa escort beşiktaş escort beykent escort beylikdüzü escort beylikdüzü türbanlı escort beyoğlu escort büyükçekmece escort cevizlibağ escort çapa escort çatalca escort esenler escort esenyurt escort esenyurt türbanlı escort etiler escort eyüp escort fatih escort fındıkzade escort florya escort gaziosmanpaşa escort güneşli escort güngören escort halkalı escort ikitelli escort istanbul escort kağıthane escort kayaşehir escort küçükçekmece escort mecidiyeköy escort merter escort nişantaşı escort sarıyer escort sefaköy escort silivri escort sultangazi escort suriyeli escort şirinevler escort şişli escort taksim escort topkapı escort yenibosna escort zeytinburnu escort porno 1080p porno izle 4k porno izle 720p porno izle abella danger alman alman porno alman porno izle aloha tube porno amatör amatör porno amatör porno izle anal anal porno anal porno izle arap porno asa akira porno asyalı porno bangbros porno bangbros porno izle banyoda sikis başörtülü porno beeg porno izle beyaz tenli porno izle biseksuel porno izle bisexsuel porno brandi love porno brazzers brazzers porno izle canli porno canli porno izle çinli porno çinli porno izle ensest porno ensest porno izle ensest seks erotik porno erotik porno izle esmer porno esmer porno izle etek altı fake agent fake taxi fake taxi porno fantazi pornoları fantezi porno izle fetiş porno fetiş porno izle fetish fransız porno fransız porno izle full hd hg porno izle gangbang porno genç kız porno izle genç kız sikişi genç teen porno izle gizli çekim porno gizli çekim pornosu grup pornosu grup porno grup porno izle hd pornolar hd porno hd porno izle hemşire porno hemşire pornosu hizmetçi porno hizmetçi porno izle ingiliz porno japon pornoları japon porno kızlık bozma kızlık bozma porno izle konulu porno konulu porno izle koreli porno köylü pornoları kumral porno kumral porno izle latin pornoları latin porno latin porno izle lezbiyen pornoları lezbiyen porno lezbiyen porno izle lisa ann porno liseli pornoları liseli porno liseli porno izle manken porno manken porno izle masaj porno izle masturbasyon porno izle masturbasyon pornoları mature porno mia khalifa porno mia malkova porno milf porno izle mobil porno mobil porno izle öğrenci porno izle öğretmen porno izle okul porno izle olgun kadın pornosu olgun porno oral porno oral porno izle oral seks porna izle pornhub pornhub porno izle porno film izle porno indir porno izle porno resimler porno star porntube porno izle redtube redtube pornoları riley reid porno rokettube rus pornoları rus porno rus porno izle sakso blowjob porno izle sarışın pornoları sarışın porno sarışın porno izle sarışın pornoları sekreter porno shemale sikiş sikiş sikiş izle şişman porno siyahi pornoları suriyeli pornoları swinger porno tecavüz porno teen porn türbanlı pornoları türbanlı porno türk pornoları türk porno türk porno izle türkçe altyazılı porno türkçe altyazılı porno izle xhamster pornoları xhamster porno xhamster porno izle xnxx xnxx porno xnxx porno izle xvideos xvideos porno izle yaşlı porno yeşilçam porno izle youjizz youporn youporn porno izle zenci porno güvenilir bahis siteleri bahis siteleri casino deneme bonusu casino siteleri deneme bonusu para yatırma bonusu bahis siteleri casino siteleribahis sitesi para yatırma