Ankura CTIX FLASH Update - July 19, 2022

Ransomware/Malware Activity

Roaming Mantis Conducting Smishing Campaign Against French Android and iOS Users

An ongoing smishing campaign has recently been observed targeting Android and iOS users in France with the "MoqHao" (aka "XLoader" for Android) malware. This campaign is attributed to Roaming Mantis, a Chinese financially motivated threat group with a history of targeting the United States, the United Kingdom, Japan, South Korea, Taiwan, and Germany. Researchers at SEKOIA.IO detailed that the campaign's lure contains a malicious URL as well as a message about a package that must be reviewed. Once a French user clicks the link, an iOS user is redirected to an Apple credential harvesting webpage. Android users are redirected to a site that delivers the installation file for a malicious Android Package Kit (APK). The APK, which corresponds to the XLoader malware, then executes and mimics a Chrome installation, which prompts the user for risky permissions