DNS changer in malicious mobile app used by Roaming Mantis
released on 2023-01-19 @ 07:09:20 PM
Kaspersky has been investigating the actor’s activity throughout 2022, and have observed a DNS changer function used for getting into Wi-Fi routers and undertaking DNS hijacking. This was newly implemented in the known Android malware Wroba.o/Agent.eq (a.k.a Moqhao, XLoader), which was the main malware used in this campaign.