All actors

Roaming Mantis

Also reported as Roaming Mantis Group and Shaoye.

Reports
37
Last reported
Known CVEs
44
ID
roaming-mantis
Merge evidence
2 alias matches

Reports per quarter

  1. 2016 Q2: 1 report
  2. 2016 Q3: no reports
  3. 2016 Q4: no reports
  4. 2017 Q1: no reports
  5. 2017 Q2: no reports
  6. 2017 Q3: no reports
  7. 2017 Q4: no reports
  8. 2018 Q1: no reports
  9. 2018 Q2: 2 reports
  10. 2018 Q3: no reports
  11. 2018 Q4: 2 reports
  12. 2019 Q1: 2 reports
  13. 2019 Q2: no reports
  14. 2019 Q3: 2 reports
  15. 2019 Q4: no reports
  16. 2020 Q1: 2 reports
  17. 2020 Q2: 2 reports
  18. 2020 Q3: no reports
  19. 2020 Q4: no reports
  20. 2021 Q1: no reports
  21. 2021 Q2: 1 report
  22. 2021 Q3: 1 report
  23. 2021 Q4: no reports
  24. 2022 Q1: 3 reports
  25. 2022 Q2: 1 report
  26. 2022 Q3: 4 reports
  27. 2022 Q4: no reports
  28. 2023 Q1: 5 reports
  29. 2023 Q2: no reports
  30. 2023 Q3: no reports
  31. 2023 Q4: no reports
  32. 2024 Q1: no reports
  33. 2024 Q2: no reports
  34. 2024 Q3: no reports
  35. 2024 Q4: no reports
  36. 2025 Q1: no reports
  37. 2025 Q2: no reports
  38. 2025 Q3: no reports
  39. 2025 Q4: no reports
  40. 2026 Q1: no reports
  41. 2026 Q2: 9 reports
Dated reports, 2016 Q2 to 2026 Q2.

CVEs named in reports

Show all 44 CVEs Show fewer

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

  1. MoqHao (Malware Family)

    date ORKL added it fromORKL

  2. Moqhao masters new tricks

    date in the title fromORKL

Show all 37 reports Show fewer
  1. Moqhao masters new tricks

    Malpedia library date fromORKL

  2. MoqHao Part 3- Recent Global Targeting Trends

    date in the title fromORKL

  3. MoqHao Android malware analysis and phishing campaign

    date in the title fromORKL

  4. Ongoing Roaming Mantis smishing campaign targeting France

    date in the title fromORKL

  5. MoqHao Part 2- Continued European Expansion

    date in the title fromORKL

  6. Roaming Mantis reaches Europe

    date in the CCS '25 data Kaspersky fromORKLCCS '25 data

  7. Roaming Mantis reaches Europe

    date in the title fromORKL

  8. 2018 Master Table

    file creation date fromORKL

  9. 2018_ A Year of Cyber Attacks – HACKMAGEDDON

    date in the CCS '25 data Hackmageddon fromORKLCCS '25 data

  10. Attackers Behind GozNym Trojan Set Sights on Europe

    date in the title fromORKL

Newest first. Details opens the report in Explore.