Last seven days
- First activity
- Sep 10, 2026
- Last activity
- Sep 10, 2026
- Feed role
- C2
- Host form
- 0 IP / 1 hostnames
Mantax Otax
Mantax Otax is an Android hybrid ransomware and spyware family associated with likely Indonesian operators and victims.
Profile source: Mallory opens in a new tabMantax Otax
Family profile
Mantax Otax is an Android hybrid ransomware and spyware family associated with likely Indonesian operators and victims. It is distributed through malicious sideloaded Android applications, including via phishing, shared links, messaging applications, and social-engineering lures. The malware requests device-administrator, sensitive runtime, and Accessibility permissions, enabling broad device control and screen-content access.
On Android 9 and earlier, Mantax Otax encrypts user files in shared storage using AES, deletes originals, displays ransom notices, and provides an attacker-operated chat interface for ransom negotiation. Android scoped-storage protections substantially reduce its file-encryption reach on Android 10 and later, but do not prevent its surveillance and data-theft functions.
Mantax Otax collects device, account, location, browser, contact, call-log, SMS, notification, gallery, and installed-application data. It can capture SMS one-time passwords, lock-screen PINs through fraudulent overlays, and WhatsApp and Telegram information through Accessibility-driven interaction. It captures screenshots, records and streams the display, covertly takes photographs with device cameras, and exfiltrates collected material to its operators. Later variants add remote application and screen blocking, touch interception, persistent dialogs, fullscreen multimedia overlays, and remote text-to-speech harassment to coerce victims into paying.
Capabilities
- Credential Theft
- Defense Evasion
- Exfiltration
- Extortion
- Post Exploitation
- Reconnaissance
C2 tracking
Seven-day C2 activity
Derp observations, rolling seven-day window
1 Sep 9
Observed infrastructure
Leading locations
- US1
Leading providers
- Cloudflare, Inc.1
Infrastructure traits
- Anycast 1
- Hosting 1
MITRE ATT&CK
Mantax Otax in ATT&CK
23 distinct techniquesTechniques
23 techniques T1204.002 Malicious File T1567 Exfiltration Over Web Service T1111 Multi-Factor Authentication Interception T1568.002 Domain Generation Algorithms T1548.004 Elevated Execution with Prompt T1071.001 Web Protocols T1486 Data Encrypted for Impact T1548 Abuse Elevation Control Mechanism T1125 Video Capture T1566.002 Spearphishing Link T1102.002 Bidirectional Communication T1114 Email Collection T1056.002 GUI Input Capture T1005 Data from Local System T1566 Phishing T1113 Screen Capture T1056 Input Capture T1102 Web Service T1083 File and Directory Discovery T1567.002 Exfiltration to Cloud Storage T1070.004 File Deletion T1614.001 System Language Discovery T1082 System Information Discovery
Reporting
