Zimperium Details Mantax Otax Android Spyware-Ransomware
Summary
Zimperium’s zLabs details Mantax Otax v2, an Android spyware-ransomware linked to Indonesian actors. It spreads through sideloaded APKs, steals credentials and surveillance data, and mainly encrypts files on Android 9 and earlier; Firebase supports C2 and extortion.
Key points
- Zimperium’s zLabs reports that Mantax Otax v2 is linked to Indonesian actors and appears to target Indonesian victims.
- The malware is distributed as sideloaded Android APKs, including through file-sharing services, messaging, phishing, and social engineering.
- It requests broad device permissions and can steal PINs, SMS, contacts, call logs, browser history, location, app data, and messaging content.
- It can capture screenshots, record or stream the screen, and secretly take photos; the research says captured media is sent through Catbox.
- On Android 9 and earlier, it uses AES to encrypt files, appends .enc, and displays ransom notices. Scoped Storage limits its file access on Android 10 and later.
- Dynamic C2 resolution and Firebase support device registration and remote commands; the researchers say a Firebase misconfiguration exposed extortion dialogues.
- The v2 variant adds WebSocket communication and remote screen blocking, app blocking, disruptive overlays, and text-to-speech commands.
Article Details
- Attack Vectors
- Malicious Android APKs are distributed through third-party file-sharing services and shared links, messaging platforms, phishing, and social engineering; victims are persuaded to install them through sideloading.
- After installation, the malware requests device administrator privileges and sensitive permissions, including SMS, contacts, audio, images, and accessibility access.
- The malware resolves its active C2 domain dynamically from a GitHub repository, registers infected devices, and receives commands through Firebase infrastructure.
- The malware uses Accessibility services, overlays, and simulated user actions to collect credentials and private messages, disrupt device use, and control the interface.
- Defensive Notes
- The article states that Zimperium Mobile Threat Defense and Runtime Application Protection (zDefend) detect the reported samples.
- The article says Mobile Threat Defense Web Content Filtering can block traffic to malicious delivery websites and C2 endpoints.
- The article reports that Android 10 and later restrict the ransomware's file access through Scoped Storage, limiting the files it can encrypt.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//apimantax[.]otax[.]fun | Dynamic C2 URL retrieved by the malware from a GitHub repository. |
MITRE ATT&CK
T1417.002The malware captures the lock-screen PIN and displayed UI content.T1418The malware collects installed application package lists and local application inventories.T1426The malware collects device details including hardware specifications, Android version, network operator, and Android ID.T1429The article reports that the malware captures audio recordings from infected devices.T1430The malware collects and transmits the victim device's geographic location during registration and surveillance.T1453The malware uses Accessibility services to harvest WhatsApp profiles and messages and perform actions on the device.T1486 · Data Encrypted for ImpactOn Android 9 and earlier, the ransomware encrypts user files with AES, removes the originals, and appends .enc to encrypted files.T1513The malware captures screenshots, records screen video, and streams display content using MediaProjection.T1516The malware simulates clicks and gestures and uses a transparent overlay to intercept touch input.T1517The malware monitors system notifications and incoming SMS messages, including messages that may contain OTPs.T1582The article reports that the malware can read and send SMS messages.T1636.004The malware harvests SMS messages from infected devices, including OTPs delivered by text.T1646The malware sends stolen data, including screenshots and recordings, to operators through C2 infrastructure.T1655.001The malware disguises its device-locking routine as a legitimate system lock process and can pretend to be a legitimate app.T1660The article reports phishing messages and social engineering used to persuade victims to install the APK.
Malware
Vendors
Products
AndroidZimperium’s zLabs uncovered Mantax Otax v2, a highly aggressive Android threat linked to Indonesian actors that combines spyware, data theft, remote surveillance, and ransomware in one campaign.Firebase Realtime Databasescreens and photos, and encrypts files on older Android devices while coordinating extortion through Firebase and a dynamic C2 infrastructure.Mobile Runtime Protection (zDefend)Zimperium customers using either Mobile Threat Defense (MTD) and Runtime Application Protection (zDefend), are fully protected against Mantax Otax ransomware and spyware campaign.Mobile Threat DefenseZimperium customers using either Mobile Threat Defense (MTD) and Runtime Application Protection (zDefend), are fully protected against Mantax Otax ransomware and spyware campaign.