Roaming Mantis

Roaming Mantis, also known as Shaoye, is a financially motivated threat actor first reported in 2017. The group primarily targets mobile device users across several countries, with a particular focus on the Asian region, including Japan, South Korea, and Taiwan. This long-term cyberattack campaign uses malicious Android package (APK) files to control infected Android devices and steal data. It also employs phishing pages to pilfer user credentials. The Roaming Mantis campaign was initially observed using SMS to distribute its malware to Android devices based in South Korea. From 2019 to 2022, cybersecurity firm Kaspersky noted that the Roaming Mantis campaign predominantly used smishing, a form of phishing involving deceptive text messages, to deliver a malicious URL to their landing page. In 2018, Kaspersky first detected Roaming Mantis activities targeting the Asian region. The structure of the Roaming Mantis campaign was closely observed in March and June 2022, revealing the sophisticated tactics employed by this threat actor. A significant aspect of the Roaming Mantis campaign in 2022 involved spreading an Android app capable of modifying DNS settings on Wi-Fi routers through the administration interface. This tactic added a new level of potential disruption and data theft to their arsenal. Studying and understanding these evolving tactics and techniques is critical in mitigating threats from groups like Roaming Mantis, allowing for proactive blocking of threats before they are even recognized as malware.