Cybersecurity firm Kaspersky discovered a new Android malware that takes control of users device by hacking routers. It also leads the user to genuine looking websites build by it to rob their information. The malware supports content in 27 languages, including Hindi, Chinese, Arabic, Bulgarian and Russian.
The company added, “Kaspersky Lab’s findings indicate that the attackers behind Roaming Mantis seek out vulnerable routers for compromise, and distribute the malware through a simple yet very effective trick of hijacking the DNS settings of those infected routers”.
“The malware included support for four languages: Korean, simplified Chinese, Japanese, and English. The attack range has now been extended, supporting 27 languages in all, including Polish, German, Hindi, Arabic, Bulgarian and Russian,” it said.
DNS converts the name of websites into digital addresses and helps them connect with servers on which websites are hosted.
The Russian cybersecurity firm was unsuccessful in finding the method which the malware uses to hack routers. But the firm said that once the malware successful it hijacks the DNS.
Also, any attempt by users to access any website leads them to a genuine-looking URL with forged coming from the attackers’ server like page requesting the user to download the newest version of chrome browser for a better experience or update for any other social media app to add new features etc.
Most of the credit card companies use two-factor authentication to complete the transaction. It includes a one-time password to the user on their mobile phones for verification.
The Kaspersky Lab researchers informed that a new Android malware distributed via domain name system (DNS) hijacking technique. The malware mainly targeting smartphones in Asia. The researchers detected that even after four weeks the threat continues to evolve rapidly. At present, it has extended its aim to geography to include Europe and the Middle East, attaching a phishing option for iOS devices and PC crypto-mining ability.
Kaspersky Lab’s initial research exposed around 150 targets. Especially, in South Korea, Bangladesh, and Japan. But the firm also disclosed thousands of connections hitting the attackers’ command. And also directs servers on a daily basis, pointing to a far larger scale of attack.