Security1 publisher3 min readPublished
MantaxOtax keys its Android ransomware to each victim's Android ID
Zimperium's September 9 write-up describes an Indonesian-linked family that encrypts files and streams the screen at once, resolves its command server through a GitHub repository, and loses most of its encryption reach on Android 10.
The Watch · Security desk
What happened
- Zimperium's zLabs team published a technical write-up on September 9 describing MantaxOtax, an Android family that encrypts a victim's files and surveils the same handset, and attributed it to Indonesian threat actors.
- The app requests device administrator privileges, then SMS, contacts, audio and image access, and finally Android Accessibility, which hands it broad control over device interactions.
- It resolves its live command-and-control domain from a GitHub repository, which Zimperium says lets the operators move to new infrastructure without shipping new code when a domain is blocked.
- The malware abuses Android's MediaProjection API for screenshots, MP4 recording and near-real-time streaming, staging captures on the Catbox file host and sending the links to its operators.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint Per-device keying means no recovered sample produces a decryptor that helps a second victim, so incident response on an Android 9 handset has no offline recovery path.
- exposure Because collection includes SMS one-time passwords, Telegram credentials and linked Google accounts, a single infected phone becomes an account-takeover problem for services that never sat on the device.
- decision On current Android the ransom pressure comes from locking and PIN capture rather than encrypted files, which changes what a helpdesk is triaging when a user reports a phone they cannot unlock.
- precedent Hosting C2 resolution on a public code repository puts the takedown decision with a platform abuse desk, and leaves domain blocklists a rotation behind the operators.
The one fixed element in that setup is the repository. Rotating a domain costs the operators a commit; matching them costs defenders a new blocklist entry after every rotation [5]. The resolver, not the C2, is the durable indicator, and it sits on a code-hosting platform with an abuse desk rather than on a bulletproof host.
Zimperium found samples distributed as a standalone Android package on a third-party file-sharing service, so the infection starts with a user tapping through an unknown-sources warning [3]. Accessibility, the last permission in the chain, is where the surveillance lives: it is how the malware reads WhatsApp profiles and messages and lifts Telegram credentials and chat histories [13]. The rest of the collection set is broad and mostly unremarkable for this class, with two entries that matter more than the ransom: SMS messages including one-time passwords, and linked Google accounts [12].
The ransomware half is version-dependent. On Android 9 and earlier it walks shared external storage, encrypts with AES, purges the originals and leaves .enc copies [6]. On Android 10 and later, Scoped Storage confines the scan to the app's own external files directory, which leaves little worth encrypting [8]. The surveillance half is indifferent to that boundary, since Accessibility, MediaProjection screen capture and silent camera use work the same on a current handset [13][14]. On a modern device the extortion leverage is therefore the routine that poses as a system lock while intercepting the PIN, plus the persistent locking, application blocking and touch-swallowing overlay in the WebSocket-based second version [20].
Per-device keying settles the decryption question. Each key is fetched from the C2 against the device's Android ID, so no two victims share one [7]. A sample pulled apart in a lab yields nothing reusable, and recovery for an Android 9 victim runs through the operators' key store or not at all.
Some builds skip leverage for attrition: repeating alert dialogues, full-screen video overlays, text-to-speech that makes the handset say the attacker's words, and image popups spawning every 600 milliseconds [17], which is 100 of them a minute [19]. Victims' own image files are also overwritten with ransom graphics [9].
Negotiation ran through an on-screen chat interface on Firebase, and a server misconfiguration exposed some of those extortion dialogues along with a screenshot of what appears to be the operators' control panel [10][15]. Targeting is inferred rather than counted: Zimperium cited language indicators and recovered victim files as the basis for the Indonesian read [15].
THost9, reported the same week, cloned banking apps into an isolated work profile to break the link between a malware alert and the fraud that followed [18]. One family is boxed in by Android's storage isolation, the other used the platform's profile isolation as cover [8][18]. The controls that bite MantaxOtax arrive before any of it: install policy for unknown sources, and knowing which apps on a managed fleet hold device administrator and Accessibility [3][4].
What to watch
- A MantaxOtax sample surfacing in an official app store rather than a file-sharing host, which would remove sideloading control as a lever.
- Follow-up reporting that puts a victim count on the Indonesian targeting, which the September 9 write-up leaves to inference.
- Takedown of the GitHub repository serving C2 resolution, and how quickly the operators stand up a replacement path.