igforum.bio / globe-trotting-roaming-mantis-malware-is-hitting-android-and-ios-users-alike-techradar - 265347
S
%Begin Globe-trotting Roaming Mantis malware is hitting Android and iOS users alike TechRadar Skip to main content TechRadar is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission.
Sofia Garcia Member
access_time 1 minutes ago
%Begin Globe-trotting Roaming Mantis malware is hitting Android and iOS users alike TechRadar Skip to main content TechRadar is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission.
thumb_up Like (29)
comment Reply (0)
share Share
visibility 543 views
thumb_up 29 likes
J
Here's why you can trust us. Globe-trotting Roaming Mantis malware is hitting Android and iOS users alike By Sead Fadilpašić published 19 July 2022 Roaming malware has made its way to France (Image credit: Shutterstock.com) Audio player loading… Roaming Mantis, an Android malware (opens in new tab) operation that aims to steal sensitive data, and potentially even money, from its victims, has now set its sights to the people of France, cybersecurity researchers are saying.  Before targeting the French, Roaming Mantis attacked people in Germany, Taiwan, South Korea, Japan, the US, and the U.K., BleepingComputer reports. This is not the same thing as the Mantis botnet, which recently emerged as one of the largest and most powerful botnets to ever appear.
Julia Zhang Member
access_time 4 minutes ago
Here's why you can trust us. Globe-trotting Roaming Mantis malware is hitting Android and iOS users alike By Sead Fadilpašić published 19 July 2022 Roaming malware has made its way to France (Image credit: Shutterstock.com) Audio player loading… Roaming Mantis, an Android malware (opens in new tab) operation that aims to steal sensitive data, and potentially even money, from its victims, has now set its sights to the people of France, cybersecurity researchers are saying.  Before targeting the French, Roaming Mantis attacked people in Germany, Taiwan, South Korea, Japan, the US, and the U.K., BleepingComputer reports. This is not the same thing as the Mantis botnet, which recently emerged as one of the largest and most powerful botnets to ever appear.
thumb_up Like (8)
comment Reply (2)
thumb_up 8 likes
comment 2 replies
N
Noah Davis 4 minutes ago
Tens of thousands of victims The operation migration was spotted by cybersecurity researchers from S...
W
William Brown 2 minutes ago
Users outside the country, getting the SMS, are safe, as the servers will show a 404 and stop the at...
L
Tens of thousands of victims The operation migration was spotted by cybersecurity researchers from SEKOIA. After analyzing the campaign, the researchers discovered that the methodology hasn't changed much: the victims would first get an SMS, and depending on whether they're an iOS, or Android user, would be redirected to different sites.  Apple users would be redirected to a phishing page where the attackers would try and trick them into giving away their credentials, while Android users would be invited to download XLoader (MoqHao), powerful malware that allows threat actors remote access to the compromised endpoint, access to sensitive data, as well as SMS apps (possibly to expand the operation further).  The researchers believe Roaming Mantis roamed to France in February 2022.
Liam Wilson Member
access_time 3 minutes ago
Tens of thousands of victims The operation migration was spotted by cybersecurity researchers from SEKOIA. After analyzing the campaign, the researchers discovered that the methodology hasn't changed much: the victims would first get an SMS, and depending on whether they're an iOS, or Android user, would be redirected to different sites.  Apple users would be redirected to a phishing page where the attackers would try and trick them into giving away their credentials, while Android users would be invited to download XLoader (MoqHao), powerful malware that allows threat actors remote access to the compromised endpoint, access to sensitive data, as well as SMS apps (possibly to expand the operation further).  The researchers believe Roaming Mantis roamed to France in February 2022.
thumb_up Like (36)
comment Reply (1)
thumb_up 36 likes
comment 1 replies
B
Brandon Kumar 1 minutes ago
Users outside the country, getting the SMS, are safe, as the servers will show a 404 and stop the at...
W
Users outside the country, getting the SMS, are safe, as the servers will show a 404 and stop the attack.  Apparently, the campaign is quite a success, as more than 90,000 unique IP addresses have downloaded XLoader from the main command & control server so far, the researchers have found. With iOS users in the mix, the number grows even further but is, unfortunately, impossible to determine. Read more> This Android malware is so dangerous, even Google is worried (opens in new tab) > Beware - another dangerous Android malware has had millions of downloads from the Google Play Store (opens in new tab) > Looking for the best Android antivirus? We've got you covered (opens in new tab) Roaming Mantis is also quite good at keeping a low profile and evading antivirus solutions.
William Brown Member
access_time 16 minutes ago
Users outside the country, getting the SMS, are safe, as the servers will show a 404 and stop the attack.  Apparently, the campaign is quite a success, as more than 90,000 unique IP addresses have downloaded XLoader from the main command & control server so far, the researchers have found. With iOS users in the mix, the number grows even further but is, unfortunately, impossible to determine. Read more> This Android malware is so dangerous, even Google is worried (opens in new tab) > Beware - another dangerous Android malware has had millions of downloads from the Google Play Store (opens in new tab) > Looking for the best Android antivirus? We've got you covered (opens in new tab) Roaming Mantis is also quite good at keeping a low profile and evading antivirus solutions.
thumb_up Like (31)
comment Reply (1)
thumb_up 31 likes
comment 1 replies
N
Nathan Chen 3 minutes ago
It gets C2 configuration from hardcoded Imgur profile destinations, further encoded in base64, it wa...
A
It gets C2 configuration from hardcoded Imgur profile destinations, further encoded in base64, it was said.  Other than that, the campaign's infrastructure is mostly the same, compared to April, when it was last analyzed, the publication found. The servers still have open ports at TCP/443, TCP/5985, TCP/10081, and TCP/47001, and use the same certificates. "Domains used inside SMS messages are either registered with Godaddy or use dynamic DNS services such as duckdns.org," SEKOIA said. Keep your devices secure with the best firewalls (opens in new tab) around Via: BleepingComputer (opens in new tab) Sead Fadilpašić Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina.
Andrew Wilson Member
access_time 5 minutes ago
It gets C2 configuration from hardcoded Imgur profile destinations, further encoded in base64, it was said.  Other than that, the campaign's infrastructure is mostly the same, compared to April, when it was last analyzed, the publication found. The servers still have open ports at TCP/443, TCP/5985, TCP/10081, and TCP/47001, and use the same certificates. "Domains used inside SMS messages are either registered with Godaddy or use dynamic DNS services such as duckdns.org," SEKOIA said. Keep your devices secure with the best firewalls (opens in new tab) around Via: BleepingComputer (opens in new tab) Sead Fadilpašić Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina.
thumb_up Like (8)
comment Reply (2)
thumb_up 8 likes
comment 2 replies
A
Amelia Singh 2 minutes ago
He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regu...
J
Jack Thompson 2 minutes ago
He's also held several modules on content writing for Represent Communications. See more Comput...
S
He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he's written for numerous media outlets, including Al Jazeera Balkans.
Scarlett Brown Member
access_time 30 minutes ago
He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he's written for numerous media outlets, including Al Jazeera Balkans.
thumb_up Like (17)
comment Reply (0)
thumb_up 17 likes
H
He's also held several modules on content writing for Represent Communications. See more Computing news Are you a pro? Subscribe to our newsletter Sign up to theTechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Hannah Kim Member
access_time 14 minutes ago
He's also held several modules on content writing for Represent Communications. See more Computing news Are you a pro? Subscribe to our newsletter Sign up to theTechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
thumb_up Like (44)
comment Reply (3)
thumb_up 44 likes
comment 3 replies
D
Dylan Patel 7 minutes ago
Thank you for signing up to TechRadar. You will receive a verification email shortly....
J
Julia Zhang 10 minutes ago
There was a problem. Please refresh the page and try again. MOST POPULARMOST SHARED1You may not have...
Show 1 more replies
T
Thank you for signing up to TechRadar. You will receive a verification email shortly.
Thomas Anderson Member
access_time 8 minutes ago
Thank you for signing up to TechRadar. You will receive a verification email shortly.
thumb_up Like (31)
comment Reply (3)
thumb_up 31 likes
comment 3 replies
E
Elijah Patel 3 minutes ago
There was a problem. Please refresh the page and try again. MOST POPULARMOST SHARED1You may not have...
I
Isabella Johnson 4 minutes ago
Globe-trotting Roaming Mantis malware is hitting Android and iOS users alike TechRadar Skip to main...
Show 1 more replies
M
There was a problem. Please refresh the page and try again. MOST POPULARMOST SHARED1You may not have to sell a body part to afford the Nvidia RTX 4090 after all2Apple October launches: the new devices we might see this month3Google's AI editing tricks are making Photoshop irrelevant for most people4One of the world's most popular programming languages is coming to Linux5The iPhone 14 Pro is made of the wrong stuff; the Pixel 7 proves that to me1We finally know what 'Wi-Fi' stands for - and it's not what you think2Best laptops for designers and coders 3The iPhone 14 Pro is made of the wrong stuff; the Pixel 7 proves that to me4Miofive 4K Dash Cam review5Logitech's latest webcam and headset want to relieve your work day frustrations Technology Magazines (opens in new tab)● (opens in new tab)The best tech tutorials and in-depth reviewsFrom$12.99 (opens in new tab)View (opens in new tab)
Madison Singh Member
access_time 9 minutes ago
There was a problem. Please refresh the page and try again. MOST POPULARMOST SHARED1You may not have to sell a body part to afford the Nvidia RTX 4090 after all2Apple October launches: the new devices we might see this month3Google's AI editing tricks are making Photoshop irrelevant for most people4One of the world's most popular programming languages is coming to Linux5The iPhone 14 Pro is made of the wrong stuff; the Pixel 7 proves that to me1We finally know what 'Wi-Fi' stands for - and it's not what you think2Best laptops for designers and coders 3The iPhone 14 Pro is made of the wrong stuff; the Pixel 7 proves that to me4Miofive 4K Dash Cam review5Logitech's latest webcam and headset want to relieve your work day frustrations Technology Magazines (opens in new tab)● (opens in new tab)The best tech tutorials and in-depth reviewsFrom$12.99 (opens in new tab)View (opens in new tab)
thumb_up Like (50)
comment Reply (0)
thumb_up 50 likes

Write a Reply

Similar Discussions