Roaming Mantis

Executive Summary

Roaming Mantis, also known as Shaoye, is a nation-state threat actor primarily involved in espionage activities targeting key sectors such as technology, defense, and government in countries like Russia, Japan, India, and Iran. The group employs sophisticated tactics, including the use of malicious APKs for mobile device compromise, and has demonstrated persistence in global operations over several years.

Goals & Targeting

Roaming Mantis's strategic objectives center on espionage and intelligence gathering, particularly from targeted sectors in specific countries. Their focus on regions like Russia, Japan, India, and Iran suggests a geopolitical agenda, possibly linked to surveillance or competitive advantage. The group's victims typically include government entities, defense companies, and technology firms, indicating a proactive approach to data collection for strategic gain.

Roaming Mantis, identified by aliases including Shaoye, operates as a state-sponsored threat group with a primary focus on espionage. The actor is known to target critical sectors such as technology, defense, and government across multiple countries, including Russia, Japan, India, Iran, and others. Their operational手法 includes the deployment of malicious APKs targeting mobile devices, indicative of their ability to compromise endpoints and gather sensitive information. While the exact origin of Roaming Mantis remains unclear, their activities suggest a high degree of sophistication, likely associated with a nation-state-sponsored program.

Key Capabilities

• State-sponsored espionage
• Development and deployment of malicious APKs
• Spear-phishing campaigns targeting mobile devices
• Persistence and lateral movement within victim networks

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Roaming Mantis has been observed conducting long-term campaigns targeting high-value assets in multiple countries. Their operational tempo is inconsistent but suggests a patient and deliberate approach to compromising targets. Campaigns often involve the distribution of malicious software via phishing attacks, with a focus on infiltrating government and defense sector organizations.

IOC Patterns

• Spear-phishing emails delivering malicious APK attachments
• Mobile device infections from known Roaming Mantis campaigns
• Lateral movement within networks using custom tools

Recommended Actions

• Implement robust mobile security solutions to detect and block malicious APKs.
• Conduct regular phishing simulations to train employees on identifying spear-phishing attempts.
• Monitor for异常 network traffic indicative of espionage activities.
• Enhance endpoint detection and response capabilities to identify and mitigate malicious activity.

Suggested Tags