{"id":31798,"date":"2022-02-10T12:43:59","date_gmt":"2022-02-10T09:43:59","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=31798"},"modified":"2026-03-28T00:21:18","modified_gmt":"2026-03-27T21:21:18","slug":"advanced-malicious-campaign-moves-from-east-to-west","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/advanced-malicious-campaign-moves-from-east-to-west\/","title":{"rendered":"Advanced malicious campaign moves from East to West"},"content":{"rendered":"\n

Kaspersky discovered that a malicious campaign dubbed Roaming Mantis, previously targeting mostly Asian regions, is expanding its infections via actively smishing (attacking through phishing mobile text messages and redirecting users to malicious content) new targets in Germany and France. The actor behind the campaign spreads mobile malware and phishing pages to collect targets\u2019 private information and steal their money. The infected device then sends SMiShing messages to the next set of targets, like those that are in the user\u2019s list of contacts for example.<\/strong><\/p>\n\n\n\n

In April 2018, Kaspersky researchers first\u00a0discovered\u00a0<\/a>the Roaming Mantis. At the time, these cybercriminals only infected Android smartphones and targeted mostly Asian regions (South Korea, Bangladesh, and Japan). The campaign has evolved significantly in a short period of time. Since 2018, they have used various attack methods such as\u00a0phishing<\/a>,\u00a0mining<\/a>,\u00a0smishing<\/a>,\u00a0and\u00a0DNS-hijacking<\/a>. The group has now expanded its geography, adding European countries to its main target regions.<\/p>\n\n\n\n

\"\u0643\u0627\u0633\u0628\u0631\u0633\u0643\u064a<\/a><\/figure>\n\n\n\n

The most affected countries are France, Japan, India, Germany, and Korea<\/em><\/p>\n\n\n\n

Typically, the smishing messages contain a very short description and a URL to a landing page. If a user clicks on the link and opens the landing page, there are two scenarios in the Roaming Mantis campaign. In the first scenario, if it\u2019s an iOS user, they are redirected to a phishing page imitating the official Apple website and are prompted to\u00a0input the credentials. In the second scenario, the\u00a0Android device gets infected by malware\u00a0after clicking on the link in the smishing message. Then the actor starts sending SMiShing messages to new targets via the infected device, both from the user\u2019s list of contacts and generated phone numbers.\u00a0SMS texts, as a more personal communication channel, also naturally lower a person\u2019s defenses against threats, as users usually do not expect to receive a malicious message from the people they know.\u00a0This campaign against both iOS and Android users in France and Germany was so active that\u00a0the police<\/a>\u00a0and\u00a0local media<\/a>\u00a0published SMiShing alerts.<\/p>\n\n\n\n

\"\u0643\u0627\u0633\u0628\u0631\u0633\u0643\u064a<\/a><\/figure>\n\n\n\n

SMiShing alerts on German and French websites<\/em><\/p>\n\n\n\n

The actor sets up a feature so that it always checks the region of the infected Android device in order to display a phishing page in the corresponding language. In previous versions it was only used to check for three regions: Hong Kong, Taiwan, and Japan. Kaspersky experts observed an update in the latest version of the payload part, and now Germany and France have been added as new regions. Using the native language of targets allows the actor to manipulate a user\u2019s decision-making and eventually convinces them to share their personal information and bank details.<\/p>\n\n\n\n

Compared to earlier versions, there is also a new modification in the backdoor commands. The developer added backdoor commands to steal photos from infected devices, but information on how exactly the actor uses stolen pictures has not yet been found. However, cybercriminals often use personal photos to get money through blackmail or sextortion. <\/p>\n\n\n\n

\u201cRoaming Mantis has actively evolved over the past five years, coming up with new ways to attack, as well as expanding the territory of targeted countries. We predict these attacks will continue in 2022 because of the strong financial motivation, especially with the advent of new backdoor features that allow the actor to use victims’ photos. To keep users around the world safe, we are constantly researching and reporting on the latest Roaming Mantis activity<\/em>,\u201d<\/em> comments Suguru Ishimaru, senior security researcher at Kaspersky\u2019s Global Research and Analysis Team (GReAT).<\/p>\n\n\n\n

Read the full report about the Roaming Mantis part VI on\u00a0Securelist<\/a>.<\/p>\n\n\n\n

To protect yourself from the Roaming Mantis attacks of smishing, Kaspersky recommends the following:<\/strong><\/p>\n\n\n\n