“Roaming Mantis” – Assessing the Impact of Android Malware on Users

Colleagues, rapid evolution, cryptojacking, global scope, mobility and DNS hijacking. These are the traits of a Tier 1 malware threat to the 2 billion+ Android-based devices across the world and Roaming Mantis appears to have them all. This voracious malware was first identified in in Japan during March 2018 when infected routers began redirecting users to compromised websites. Roaming Mantis currently supports 27 different languages and has expanded to users on four continents. This new version contains a script for the popular cryptocurrency miner Coinhive and the capability to target iOS devices in addition to Android devices. What are the most effective mitigation techniques? Security Affairs focuses on mitigation beginning with securing routers, using up-to-date firmware, enforcing strong passwords for admin access and disabling remote access to the administration interfaces on the routers. This attack targets DNS services running on routers. A DNS service running on a server inside your network is not at risk to this attack. And only install software from trusted app stores such as Google Play and the Apple App Store. We also recommend the SecureList’s APT Mitigation in-depth checklist. Comment and subscribe today! Lawrence, Cyber Security Defender (https://cybersecuritydefender.blogspot.com)