Roaming_Mantis__2022__Kaspersky_Roaming-Mantis-reaches-Europe_02-07-2022.pdf

# Executive summary Kaspersky documents the Roaming Mantis smishing campaign spreading Android Trojans Wroba.g/Wroba.o into Europe (notably France and Germany), describing infection flow (smishing -> landing pages -> APK/phishing), large-scale telemetry (tens of thousands of APK downloads in some regions), landing page obfuscation and geo/user-agent checks, detailed technical analysis of loader/payload (embedded XOR key + zlib-decompressed DEX, JNI/native library, Kotlin rewrites), and newly added backdoor commands to exfiltrate photos/galleries; MD5 indicators are provided.