Roaming Mantis is a cyber threat actor first documented in April 2018 following Kaspersky's analysis of its DNS hijacking activities. While initially focused on Android devices and Asian regions, the group has significantly evolved its attack methods and geographical reach, now targeting both Android and iOS users across Asia and Europe. The actor, also known as Shaoye, is assessed with high confidence to be of Chinese origin. Roaming Mantis is primarily financially motivated, engaging in credential theft, banking fraud, and cryptomining. A distinguishing characteristic of the group is its adaptive use of DNS hijacking via compromised routers and SMiShing campaigns to deliver its Wroba (MoqHao/XLoader) mobile malware, consistently updating its payloads and employing geofencing to evade detection. The group has shown a unique ability to expand its targeting by incorporating new languages and adapting its attack methods to various platforms, including iOS phishing and PC cryptomining.

Aliases del actor

Roaming Mantis GroupShaoyemalicious APKMITRE: S0509referencias a países como RusiaJapónIndiaBangladeshKazajstánAzerbaijanIránVietnamestá relacionado con actividades maliciosasincluyendo la distribución de malwarela exploración de vulnerabilidades en sistemas informáticos

Actores similares

roaming-mantisactor · 1Container Orchestration Jobactor · 1roaming-tigeractor · 1Roaming Tigerapt · 0everestransomware · 365contiransomware · 351dispossessorransomware · 344malware---toolsactor · 54silentransomgroupactor · 36GroupIB_TIactor · 11