@ninoseki Thanks as always for the notification / mention!
We also just found this blog (in German), but not sure if it's the same sample or malware.
No real IOCs, but nice screenshots and earlier waves (from Aug & May 2020) linked at the bottom as well.
https://t.co/vmBSmCSRty
New blog: This year the cybercrime group #RoamingMantis has been actively targeting the European users of both #iOS and #Android devices. This post provides an insight into the rate of success in their recent advancements. https://t.co/WWKz50wxhE #Malware#Phishing@csis_cyber
I believe #RoamingMantis is a name of a campaign (which is named by Kaspersky GReAT). It is not a group.
But recently I saw some reports which use #RoamingMantis as a name of a group.
e.g.
https://t.co/XgVlrqOJNS
(by @cybereason)
https://t.co/o7y8Kt6yka
(by @CyberCSIS)
CSIS researcher (and past VB conference speaker) @s_metanka looked at how the RoamingMantis Android malware is now targeting European countries too and how the same group is engaging in Apple ID phishing https://t.co/VSlaG6SicW
@papa_anniekey Thanks for the hint!
We believe there likely is a connection.
There is some great and interesting info in this #RoamingMantis presentation from @BotConf 2019
https://t.co/fgyr4orEqw
Vorsicht vor gefälschten E-Mails im Namen der Eidgenössischen Steuerverwaltung ESTV: Beim Excel Anhang handelt es sich um Schadsoftware #guloader. Nicht öffnen!