Story image

Avoidable mistakes lead to iOS cryptomining attacks

Just five months after Kaspersky Lab’s first report on the DNS hijacking operation to infect Android smartphones in Asia, the attack dubbed ‘Roaming Mantis’ remains highly active, exploring new tricks and techniques to extend its reach. Close monitoring by Kaspersky Lab experts discovered Roaming Mantis attempting to web mine iOS devices used for legitimate crypto mining.

The malware banked on the popular CoinHive miner, the tool it first used to infect PCs. Malicious cryptocurrency mining refers to hackers infecting a crypto mining platform to mine cryptocurrency from unaware victims. Researchers also noticed that the hackers have adopted a trial and error approach to testing which technique would get them more money faster. For instance, the attacker modified the infected landing page of the malware, alternately using an Apple phishing site and a web coin-mining page.

Roaming Mantis has also boosted its attack and evasion tools. The group initially hijacked DNS systems of rogue Wi-Fi routers to infect Android users in Japan, Korea, India, and Bangladesh with Trojanized applications named facebook.apk and chrome.apk. The latest updates reveal that facebook.apk has been changed to sagawa.apk and has been spread via a rented SMS message spoofing delivery service.

This technique was first used last year by another cybergang. Kaspersky Lab also uncovered that the attacker spreads its malware via Prezi, cloud-based presentation software that allows free user accounts, making it harder for security products to detect phishing or malicious activities as this site is considered legitimate. In addition, the redirected SCAM content shows that Roaming Mantis uses templates, which suggests that Prezi is an established delivery system for malicious content, too.

Aside from the updated tools and techniques, researchers at Kaspersky Lab spotted careless mistakes committed by the hacking group as they try to dabble in additional types of attacks as fast as possible. Roaming Mantis, also known as MoqHao and XLoader, was launched in four languages and in two months quickly added two dozen more, including Asian languages --- Bengali, both traditional and simplified Chinese, Hindi, Indonesian, Japanese, Korean, Malay, Tagalog, Thai, and Vietnamese.

After this update, researchers detected mixed-ups in the language environment. For instance, Japanese users will get a pop-up message written in Korean. The group also used HTML instead of URL to redirect users to their malicious content, contrary to how Prezi as a delivery system really works.

As a result, the tweaked landing page was not able to infect its target victims. To protect your devices against Roaming Mantis attacks, Kaspersky Lab suggests users do the following:

1. Check your router’s settings.

2. Change the default login and password for admin of your devices, especially when used in crypto mining.

3. Use robust security solutions for all your devices. 4. Do not allow “Install unknown apps.”

Tensions on the rise after Huawei CFO arrest
“Recently our corporate CFO, Meng Wanzhou, was provisionally detained by the Canadian authorities on behalf of the United States of America."
Palo Alto Networks integrates RedLock and VM-Series with AWS Security Hub
AWS Security Hub is designed to provide users with a comprehensive view of their high-priority security alerts and compliance status.
Juniper simplifies data integration to improve threat detection
Updates to the Juniper Advanced Threat Prevention Appliances leverage third-party firewalls and security data sources.
Is mobile shopping compromising your enterprise security?
When employees do their holiday shopping on company resources, security teams have a challenge with the surge in browsing and online transactions.
Different approach to malware detection needed – VMware
Security needs to move away from the traditional approach of chasing after arbitrary forms of malware.
Modernising ERP systems can help organisations comply with GDPR
“Organisations need to look for modern ERP systems that are specifically designed with GDPR in mind."
APRA Prudential Standard CPS 234: How to communicate with the board
The Australian Prudential Regulation Authority’s standard, CPS 234, is aimed at minimising the threat of cyber attacks for APRA-regulated entities.
Cyber attacks develop complexity, target Windows sysad tools - report
The report explores changes in the threat landscape over the past year, uncovering trends and how they are expected to impact cybersecurity in 2019.