Mantax Otax: Indonesian Mobile Ransomware with Spyware Integration

Executive Summary

The zLabs research team has discovered a sophisticated and highly aggressive mobile malware strain linked to Indonesian threat actors, that marks a dangerous tactical evolution by seamlessly integrating comprehensive spyware capabilities with traditional ransomware functionality into a single attack vector. This hybrid threat systematically compromises user privacy through an intrusive suite of surveillance features, which includes recording device screens in real-time, extracting browser history, stealing lock screen PINs, harvesting contact lists, call logs, and SMS messages, exfiltrating local files, and capturing unauthorized photographs. In tandem with this extensive espionage and data harvesting, the malware executes its ransomware payload by encrypting data on targeted older Android versions. Immediately following a successful encryption phase, the malware alters the device interface to trigger an interactive, on-screen chat portal, establishing a direct communication channel that the threat actors strategically utilize to issue ransom demands and orchestrate the extortion process in real-time, ultimately confronting victims with a high-impact double-extortion threat.

Infection Vector

Some analysed samples appeared to be distributed as a standalone Android APK hosted on a third-party file-sharing service (Fig.1). This suggests a sideloading-based infection vector, where users are persuaded to download and install the application manually through shared links, messaging platforms, social engineering campaigns, and phishing messages. Such distribution methods are commonly used by Android malware operators to bypass official app store security controls and reach potential victims directly.

Fig.1: Malicious APKs are hosted on a third-party file-sharing platform

Technical analysis

As illustrated in Figure 2, upon installation, the malware initiates a request for device administrator privileges. Once these elevated privileges are secured, it systematically solicits an extensive suite of sensitive permissions, including access to SMS messages, contacts, audio, and images. The final phase of this escalation sequence involves requesting accessibility permissions, effectively granting the attacker comprehensive control over the device's core functionalities.

Fig.2: Permission requested by the malware

C2 communication and Device Registration

The malware utilizes HTTPS to secure communications with its Command and Control (C2) infrastructure. Notably, its operational architecture employs a dynamic C2 resolution mechanism, retrieving the active domain (hxxps://apimantax[.]otax[.]fun ) from a GitHub repository. This technique allows the threat actors to seamlessly pivot to new domains if the primary infrastructure is blocked, ensuring operational resilience without requiring code modifications.

Upon resolving and caching the active C2 server, the malware generates a unique device identifier (device_id) and transmits an initial POST request to the <C2>/register endpoint. This request (Fig.3) exfiltrates critical host telemetry, including the victim's geographic location, network operator and Android OS version. Following successful device registration, the malware establishes a persistent command-and-control loop, executing tasks dispatched via its Firebase infrastructure.

Fig.3: Victim registration communication

Malware Capabilities

Encrypting files on the device

The malware initiates its cryptographic phase by executing dynamic key retrieval from the remote command-and-control (C2) server. This request (Fig.4) contains the compromised device's unique Android ID, so each key is different for each victim.

Fig.4: Malware receiving encryption key from C2

Once the encryption key is successfully provisioned, the malware scans the local file system, targeting an extensive array of specific file extensions, including media assets (images and videos), documents, archives, databases, and cryptographic keys.

On legacy devices running Android 9 or earlier, the ransomware conducts a deep, recursive traversal of the shared external storage. While the routine deliberately bypasses the Android/data and Android/obb system directories to avoid crashing the operating system, it successfully localizes and targets the vast majority of user data.

The encryption engine utilizes the AES algorithm to lock the files. Immediately following successful encryption, the malware securely purges the original files from disk and replaces them with the encrypted variants, appending a .enc file extension to each payload (Fig.5).

Fig.5: Malware confirming the files are encrypted

To maximize psychological impact and ensure visibility, the malware targets localized image files to serve as ransom notices. It generates altered copies of these local assets, overwriting them with an embedded extortion string: "Your files have been encrypted. Pay to decrypt." Fig.6 shows the device state before infection compared with the post-encryption environment where legitimate user content is completely swapped for ransom graphics.

Fig.6: Victim’s device before and after the ransomware attack

Conversely, on modern devices running Android 10 and above, the malware’s efficacy is severely hindered by native OS defenses, specifically Scoped Storage restrictions. Due to these sandboxing rules, the ransomware is constrained to scanning only the application's localized external files directory, which drastically mitigates the blast radius and reduces the volume of accessible user files.

Upon completing the encryption cycle, the threat actor forces an interactive, on-screen chat interface onto the compromised device (Fig.7), instructing the victim to negotiate a payout. Deeper analysis into the backend infrastructure confirmed that these communications are brokered directly through Firebase. Due to a server misconfiguration, the Firebase C2 is exposing the extortion dialogues orchestrated by the attackers.

.   

Fig.7: Dialogues with attackers

Device Locking and Credential Exfiltration

The malware executes a dedicated device-locking routine by masquerading as a legitimate system lock process (Fig.8). Under the guise of this necessary administrative activity, the malware restricts user access to the device and intercepts the user's lock screen PIN. This credential-harvesting tactic is a well-documented technique employed by sophisticated mobile threats to effectively bypass native security barriers, manipulate the user into providing sensitive credentials, and secure persistent access to the physical device.

Fig.8: Malware showing system lock overlay on top of screen

PII and Communication Harvesting

The malware features an extensive data-harvesting engine engineered to systematically extract a broad spectrum of personally identifiable information (PII) and environmental data from compromised devices. Its surveillance suite is capable of capturing local application inventories, granular hardware specifications, real-time location telemetry, and comprehensive browser histories.

To achieve total visibility into user activity, the malware intercepts system notifications, contact lists, historical call logs, and inbound SMS messages, critically capturing multi-factor authentication payloads such as one-time passwords (OTPs). Furthermore, it maps the local file system, enumerates linked Google account configurations and exfiltrates media assets directly from the device gallery.

Beyond core operating system data, the threat targets instant messaging applications to breach private communications. It successfully harvests WhatsApp account profiles and messages using Accessibility services alongside Telegram user credentials and chat histories, simulating user clicks to open the chats and extracting the contact name and message content.

Remote Screen Monitoring and Catbox-Based Exfiltration

The malware integrates a dedicated surveillance component that abuses the native Android MediaProjection API to establish continuous, remote monitoring of the victim's device activity. This module is highly versatile, supporting static screenshot capture, full-motion screen recording in MP4 format, and live display streaming in near real-time. Captured screenshots are automatically compressed into JPEG format and exfiltrated to the third-party file hosting service, Catbox (Fig.9), after which the generated storage URL is transmitted directly back to the operator.

To facilitate live screen streaming, the malware periodically captures display frames, applies compression, encodes the data in Base64, and transmits the payload stream to the attacker at short intervals. Additionally, the operator can remotely initialize and terminate full-screen video recordings; the resulting MP4 files are staged on Catbox, and the corresponding download links alongside the file metadata are routed back to the command-and-control (C2) infrastructure. Together, these capabilities provide threat actors with complete operational visibility into the victim's digital environment, enabling the passive interception and theft of sensitive credentials, financial transactions, private messages, and any other confidential data rendered on the screen.

Fig.9: Screenshot of device infected

Taking pictures of victim using front and back camera

The malware can silently access the device's camera and capture photographs using either the front or rear camera. It enumerates available cameras, selects the requested camera, initializes a hidden preview surface, and captures an image without requiring visible user interaction. The captured photo (Fig.10) is compressed to reduce its size, stored locally, and then encoded in Base64 before being transmitted to the operator.

Fig.10: Front-camera picture of device infected

Infected Devices

Language indicators and files from the victims suggest that the threat actor is specifically targeting Indonesian targets. Among the files recovered due to the Firebase server misconfigurations, we identified a screenshot of what seems to be the mobile view of the C&C panel (Fig.11). The screenshot shows the number of infected devices under the control of this C2 and the information of all of them.

Fig.11: Attacker’s interface showing number of devices

Mantax Otax v2

Our research team found two versions of this malware, with one representing an evolution of the other. Notably, it has modified its network traffic behavior to utilize WebSockets (Fig.12) and introduced a set of new commands (as a reference, full V1 list of commands can be found here), which are detailed in this link. Among the new commands added, the most relevant features are the following ones:

Fig.12: The latest version of malware using websocket communication

Blocking victim’s screen

In its latest iteration, the malware exhibits advanced user interface (UI) hijacking capabilities. The variant can persistently lock the device screen, displaying a social engineering prompt that instructs victims to contact an external "administrator" for assistance (Fig.13). Additionally, upon receiving a remote <blockapp> command, the malware dynamically restricts access to any installed applications on the compromised asset. The threat is further escalated by receiving the <touchBlock> instruction, the malware creates a transparent full-screen overlay that intercepts all touch events, effectively suppressing the device's touch input and preventing the victim from performing any physical interactions, including tapping, swiping, and clicking, while leaving the underlying screen visible.

Fig.13: Blocking victim’s screen and asking to contact admin

Harassment and Spamming the victim

Mantax v2 incorporates specific routines designed to psychologically harass the user, degrade device usability, and visually obfuscate ongoing malicious background tasks through intensive user interface (UI) disruption.

Automated Dialog Spamming (<dialogSpam> / <dialogSpamStop>): Upon receiving the <dialogSpam> command, the malware continuously injects intrusive alert dialog boxes onto the foreground display. This rapid, automated loop of UI elements effectively halts standard device operations. The routine remains active until the Command and Control (C2) server transmits the <dialogSpamStop> counter-command.

Full-Screen Window Overlays (<videoOverlay>): Leveraging Android’s window overlay services, the malware forces an arbitrary video to play in full-screen mode. This mechanism serves a dual tactical purpose: it physically obstructs the victim's view and visually conceals covert malicious background processes, such as data exfiltration or credential harvesting.

"Jumpscare" Overlays (<jumpscarestart>): Triggered via a network socket connection, this function parses remote image references from the inbound payload and renders them as floating overlay popups above all other active applications. The malware implements a high-frequency loop that spawns a new overlay every 600 milliseconds, maintaining each instance for approximately 2.5 seconds before removal. This creates a severe, disorienting visual strobing effect. Also they delivered <jumpscare2Start> command, a custom one where the image and duration can be customized from the server

Remote Text-to-Speech Execution

Upon receiving the <TTS_SPEAK> command, the malware triggers the host device’s native Android Text-to-Speech (TTS) engine to vocalize a threat-actor-specified string. The component dynamically configures the playback's language, speech rate, and pitch based on remote parameters embedded within the command payload. By routing this synthesized audio directly through the asset's physical speakers, the threat actor achieves remote, arbitrary audio generation on the victim's device without relying on user interaction or visual UI components.

Zimperium vs. MantaxOtax

Zimperium customers using either Mobile Threat Defense (MTD) and Runtime Application Protection (zDefend), are fully protected against Mantax Otax ransomware and spyware campaign. Our on-device dynamic detection engine fully detects all samples in a zero day fashion.

At the same time, MTD customers have an extra protection layer provided by our Web Content Filtering capabilities which can block traffic to malicious websites delivering malware, effectively preventing the app installation and blocking traffic to C2 endpoints, preventing malicious actors from controlling or gathering data from the device in the case of a successful compromise.

MITRE ATT&CK Techniques

To help our customers and the industry understand the impact of this malware, Zimperium has compiled the following table containing the MITRE tactics and techniques as reference.

IOC

Mantax Otax IOCs can be found in this repository.