Shaoye

Shaoye, also known as Roaming Mantis, is a well-known threat actor in the cybersecurity landscape. This entity has been implicated in long-term cyberattack campaigns that primarily focus on Android devices. The modus operandi of Shaoye involves the use of malicious Android package (APK) files to gain control over infected devices and pilfer valuable data. This approach allows them to manipulate the device's functionalities and extract sensitive information, making it a significant threat to individual privacy and data security. In 2022, Shaoye launched a campaign that involved spreading an Android app with advanced capabilities. This particular application was designed to modify DNS settings on Wi-Fi routers through their administration interface. By altering these settings, Shaoye could potentially redirect traffic to malicious sites or intercept sensitive data, further enhancing their ability to execute successful cyberattacks. Besides controlling infected devices and stealing data, Roaming Mantis also employs phishing techniques to steal user credentials. The group's activities are strongly financially motivated, suggesting that they may sell stolen data or use it for fraudulent purposes. Given the sophistication of their methods and their persistence, Shaoye poses a substantial ongoing threat to cybersecurity.