Manic's mesh relay moves stolen data phone to phone, no internet path required

A mesh relay is a routing decision, not a new payload. When a compromised phone has no usable path to command and control, Manic hands what it has collected to a nearby infected device over Wi-Fi Direct or Bluetooth, and the data moves until it reaches a handset that does have egress, according to ThreatFabric ^[5]. Every control built at the network boundary, the managed VPN, the DNS sinkhole, the blocked C2 domain, sits downstream of that first hop and never sees it.

The condition for it to pay off is physical density of infected devices. That is a real constraint, and it also explains where Manic has been used: ThreatFabric reports it mainly against Ukraine, hitting banks, government services and messaging applications, with observed targeting of Russian and European financial institutions, global crypto and fintech services, and military-focused messaging apps ^[2]. Populations where handsets sit in the same room, on the same restricted or absent network, are exactly the populations where a device-to-device hop beats waiting for connectivity. Manic already logs keystrokes, throws phishing screens and takes remote control of the phone ^[3], and adds notification monitoring, location tracking, file harvesting and remote surveillance ^[4].

Zimperium's ToxicPanda 2.0 numbers point the other way, toward volume. The target list went from 16 financial applications to nearly 350 ^[10], a roughly 22-fold expansion ^[14]. That is not better targeting, it is the abandonment of targeting: infect first, find out later which banking app is installed. The 167 supported remote commands ^[10] and the automated click sequence that turns on Android Wireless Debugging to obtain privilege escalation and shell-level access ^[12] are the operator-side plumbing for handling that volume without an exploit chain. Note also the geography. A family known mainly for Europe ^[15] is now aimed at institutions in 16 countries including Pakistan, South Africa, Mexico, Nigeria, India, Indonesia and Panama ^[11], with samples delivered from Amazon AWS-hosted buckets ^[13], which makes blocking the delivery host cost the defender more than the attacker.

Grandoreiro is the least novel and the most instructive. Ten years old, Windows, Brazilian in origin, still improving after law enforcement action against it ^[7]. Acronis found recent samples sideloading through the legitimate Duplicate Files Finder application ^[8], and says the sandbox checks, VM artifact checks, process blacklisting and environment profiling all run before any attempt to contact C2 ^[9]. That ordering is the point: a detonation that never produces a callback produces no infrastructure indicator, so the threat feed most organisations actually consume learns nothing from that sample.

Three vendors described these three families in the same week ^[16] without citing each other. The convergence is in capability rather than code, and the part that should bother whoever owns mobile is narrower than the headline: the phone was already the least governable managed endpoint, and the assumption that you can at least observe or interrupt what leaves it now holds only while it is the sole infected device in the room.