sb-au logo
Story image

Avoidable mistakes lead to iOS cryptomining attacks

Just five months after Kaspersky Lab’s first report on the DNS hijacking operation to infect Android smartphones in Asia, the attack dubbed ‘Roaming Mantis’ remains highly active, exploring new tricks and techniques to extend its reach. Close monitoring by Kaspersky Lab experts discovered Roaming Mantis attempting to web mine iOS devices used for legitimate crypto mining.

The malware banked on the popular CoinHive miner, the tool it first used to infect PCs. Malicious cryptocurrency mining refers to hackers infecting a crypto mining platform to mine cryptocurrency from unaware victims. Researchers also noticed that the hackers have adopted a trial and error approach to testing which technique would get them more money faster. For instance, the attacker modified the infected landing page of the malware, alternately using an Apple phishing site and a web coin-mining page.

Roaming Mantis has also boosted its attack and evasion tools. The group initially hijacked DNS systems of rogue Wi-Fi routers to infect Android users in Japan, Korea, India, and Bangladesh with Trojanized applications named facebook.apk and chrome.apk. The latest updates reveal that facebook.apk has been changed to sagawa.apk and has been spread via a rented SMS message spoofing delivery service.

This technique was first used last year by another cybergang. Kaspersky Lab also uncovered that the attacker spreads its malware via Prezi, cloud-based presentation software that allows free user accounts, making it harder for security products to detect phishing or malicious activities as this site is considered legitimate. In addition, the redirected SCAM content shows that Roaming Mantis uses templates, which suggests that Prezi is an established delivery system for malicious content, too.

Aside from the updated tools and techniques, researchers at Kaspersky Lab spotted careless mistakes committed by the hacking group as they try to dabble in additional types of attacks as fast as possible. Roaming Mantis, also known as MoqHao and XLoader, was launched in four languages and in two months quickly added two dozen more, including Asian languages --- Bengali, both traditional and simplified Chinese, Hindi, Indonesian, Japanese, Korean, Malay, Tagalog, Thai, and Vietnamese.

After this update, researchers detected mixed-ups in the language environment. For instance, Japanese users will get a pop-up message written in Korean. The group also used HTML instead of URL to redirect users to their malicious content, contrary to how Prezi as a delivery system really works.

As a result, the tweaked landing page was not able to infect its target victims. To protect your devices against Roaming Mantis attacks, Kaspersky Lab suggests users do the following:

1. Check your router’s settings.

2. Change the default login and password for admin of your devices, especially when used in crypto mining.

3. Use robust security solutions for all your devices. 4. Do not allow “Install unknown apps.”

Story image
Organisations take cloud-first approach to security, though concerns remain
"While the results of this survey show that some security professionals still have concerns, having visibility into cloud services is vital and many organisations are now taking a cloud-first approach to security.”More
Story image
Glenn Maiden to lead FortiGuard Labs A/NZ as director of threat intelligence
Maiden will focus specifically on threat intelligence sharing for organisations across A/NZ, so that those organisations may protect their businesses from existing and emerging cyber threats.More
Story image
Marriott International reports breach affecting 5.2 million customers
Marriott said in statement that an ‘unexpected’ amount of guest information may have been accessed in mid-January this year, using the login credentials of two employees at one of the company’s franchise properties.More
Story image
DDLS offers all courses remotely during COVID-19 lockdowns
“With Virtual Instructor-led Training, DDLS can provide training in the skills organisations require immediately, in order to maintain business momentum in these very troubled and demanding times.”More
Story image
Interview: Ping Identity exec on why security system updates are critical during COVID-19
Techday spoke with Ping Identity country manager for A/NZ and Japan, Ashley Diffey, on how zero-trust is favourable over perimeter-based security, and what the changes in work mean for businesses in a post-COVID-19 world.More
Story image
ESET launches resource to protect remote workers during COVID-19
"If adequate security measures aren’t implemented on every device or network that connects to the corporate network, bad actors can go undetected."More