Skip to main content

Hit by ransomware? Isolate affected systems now. Do not reboot or reformat.

SheMo Noransom舍末无勒

Ransomware family

Mantax Otax Ransomware Decryption & Data Recovery

  • Active
  • High
  • No public decryptor

Mantax Otax is an Android ransomware family disclosed in September 2026 that bundles file encryption, screen locking and spyware into one APK. It appends .enc to encrypted files while stealing OTPs, contacts, photos and chat histories, then pressures victims with exposure and harassment. No public decryptor exists.

First seen
2026-09
File extensions
.enc
Ransom notes
No public information
Affected platforms
Android

Family profile

File extensions
  • .enc
Ransom notes
No public information
Contact patterns
  • No mailbox and no Tor negotiation portal: extortion happens in a full-screen chat inside the malicious app
  • The chat window is disguised as a system security prompt (titled SYSTEM PROTECTED), with the operator appearing under the fixed handle Mantax Bro!!
  • The negotiation backend abuses Firebase (a misconfiguration there exposed extortion dialogues)
  • The live C2 domain is published through a GitHub dead-drop repository on cheap TLDs such as .fun
  • Screenshots and screen recordings are staged through public file-hosting services such as Catbox
Aliases / versions
Mantax OTAX、Mantax、Manta X2（第二版界面自称）、Android/Spy.Agent.GGC（ESET 检出名）、HEUR:Backdoor.AndroidOS.Agent（Kaspersky 检出名）
First seen
2026-09
Status
Active
Operational status
Newly emerged
Threat level
High
Affected platforms
  • Android
Tags
  • Mobile
  • Active
  • Double extortion
  • Phishing
  • Consumer targets
Decryptor
No public decryptor

There is no free public decryptor for Mantax Otax: we found no listing on No More Ransom or in the vendor toolkits we checked, and the published research is explicit that removing the app or formatting the device will not bring encrypted files back.

The key model is why. Before encrypting, the sample requests a per-device AES key from its C2, identified by the device's Android ID, so every victim gets a different key. The key is never generated or stored on the device, which leaves no key material to recover offline, and no exploitable implementation flaw has been disclosed.

One caution that matters in practice: .enc is a generic suffix shared by several ransomware families and by many legitimate encryption tools. Most tools advertised online as ".enc decryptors" target something else entirely, and running one against Mantax Otax files only damages them further. Identify the family from actual samples first, and only ever work on copies.

Latest activity

  1. Vendor sample write-ups appeared: the lock screen poses as SYSTEM PROTECTED or Manta X2 Elite Security to harvest the PIN, AV engines flag it as spyware, and no free decryptor exists for .enc files.

    Sources

  2. Follow-up reporting detailed the mechanics: Mantax Otax encrypts shared storage, appends .enc and deletes originals, keyed per Android ID. Scoped Storage largely blocks encryption on Android 10+, but the spyware functions still work.

    Sources

  3. Zimperium zLabs published the first analysis of Mantax Otax: one Android APK combining file encryption, a fake lock screen and spyware, with per-device AES keys issued by the C2 and a second build that moved to WebSockets.

    Sources

Overview

Mantax Otax is an Android ransomware family publicly documented by Zimperium zLabs on 9 September 2026. A single APK combines file encryption, screen locking and full spyware: it encrypts photos, documents and archives on the device while continuously harvesting one-time passcodes, contacts, gallery content and WhatsApp and Telegram conversations, then pressures the victim through exposure and sustained harassment. It is mobile double extortion in the literal sense.

Public reporting attributes the operation to Indonesian actors, and both the sample strings and the observed victim files are predominantly Indonesian. Nothing published so far indicates targeted delivery against users in mainland China. Distribution bypasses the app stores entirely: standalone APKs hosted on third-party file-sharing services, delivered through messaging links, phishing texts and social-engineering pretexts, with the documented disguises including an Indonesian app name hinting at adult content and lookalike packages imitating well-known applications such as Grok.

The honest caveat is that public information on this family remains limited. There is one original vendor analysis plus derivative media coverage; no first-seen date or ransom figure has been published, and there is no authoritative infection count - the victim list researchers saw in the exposed operator backend was a point-in-time snapshot in the low hundreds of devices, which cannot be read as a total. As of this update we have found no Chinese vendor report on the family. Two builds are already known, with the second switching to WebSocket communications and adding a large set of coercion features, so the family is clearly still iterating.

How to identify it

Extension. Encrypted files get .enc appended to the full original name, so photo.jpg becomes photo.jpg.enc, and the original is deleted. Because .enc is reused by several families, the suffix alone is not an attribution.

Ransom message and lock screen. No conventional txt or html note is dropped. Instead the malware overwrites images in the device gallery with a notice stating that files are encrypted and payment is required, and raises a full-screen chat window headed SYSTEM PROTECTED, where the operator negotiates directly under the fixed handle Mantax Bro!!. The lock screen impersonates a system process, or invokes a fake security product name such as Manta X2 Elite Security, to trick the victim into entering the screen-lock PIN - which the operators then reuse to keep control of the device.

Behavioural indicators. After installation the app demands device administrator and Accessibility permissions together. What follows is a full-screen overlay that cannot be dismissed, unresponsive touch input, selected apps being blocked, repeated dialog spam, abrupt full-screen video playback and flashed "jumpscare" images, plus spoken threats read aloud on the device. Multiple vendors detect it under spyware names such as Android/Spy.Agent.GGC and the HEUR:Backdoor.AndroidOS.Agent series.

Infection vectors

The delivery chain is short and depends entirely on the user installing the app by hand:

  • Standalone APKs on third-party file-sharing services - the primary hosting channel, bypassing app-store review completely.
  • Messaging links and phishing texts - paired with social-engineering pretexts that walk the user through enabling installation from unknown sources.
  • Disguises - documented samples use an Indonesian app name hinting at adult content, and lookalike packages imitating well-known applications such as Grok, trading on curiosity to get a long permission list waved through.
  • Permission funnelling - immediately after install the app requests device administrator, Accessibility, SMS, contacts, audio, gallery and screen-recording permissions. Accessibility is the hinge: every later control capability depends on it.

One qualifier: public reporting says the known samples are detected and blocked by an up-to-date Google Play Protect, but sideloading victims have usually dismissed or disabled that warning already, so it should not be treated as sufficient defence.

For organisations the exposure is BYOD. Once an employee's personal phone is infected, the one-time passcodes for corporate mail, OA and VPN, along with work chat history, sit in plain view of the operator, and a phone-level infection can escalate into corporate account takeover.

Encryption behavior

Algorithm and keys. File contents are encrypted with AES. The key is not generated locally: the sample requests one per device from the C2, identified by the Android ID, so each victim key differs. Nothing usable is left on the device, which removes any offline recovery path.

Scope. The malware walks shared external storage recursively, covering documents, images, video, archives, databases and cryptographic material, while deliberately skipping the Android/data and Android/obb directories so as not to break the operating system. After encryption the original is deleted and .enc appended.

Platform limit (important). Scoped Storage, enforced from Android 10, tightly restricts an app's reach into external storage, so broad file encryption is largely confined to Android 9 and earlier. The spyware and screen-lock functions still work on current Android versions, meaning that even when nothing is encrypted, the privacy exposure is undiminished.

Version differences. Build one speaks HTTPS. Build two moves to WebSockets and adds app blocking, transparent overlays that swallow touch input, dialog spam, full-screen video, flashed images at roughly 600 ms intervals and remote text-to-speech threats.

C2 and exfiltration. The live C2 domain is fetched from a GitHub dead-drop repository, letting operators rotate infrastructure without repackaging the APK, and captured screenshots and recordings are relayed through public file-hosting services. Researchers also found the Firebase backend misconfigured, which exposed the extortion dialogues and the inventory of controlled devices.

Assess before you act

Recoverability assessment

Mobile extortion shifts the priorities. Whether files can be decrypted is usually not the urgent question - containing the account and privacy damage is. We do not pay ransoms and do not negotiate; our work is technical response, impact assessment and forensics.

1) Public decryptor: none. Keys are issued per device by the C2 and nothing is retained locally, and no implementation flaw has been disclosed. There is currently no viable direct decryption path for .enc files from this family, and the ".enc decryptors" circulating online target other families - do not run them.

2) Account freezes and credential rotation (highest priority). The malware steals SMS one-time passcodes, the screen-lock PIN, contacts and Google account details. Act immediately from a separate clean device: suspend or replace the SIM, freeze banking and payment accounts, reset the passwords of every account tied to that phone number, revoke suspicious sessions and connected apps, move second-factor authentication from SMS to an authenticator app or hardware key, and tell the bank and corporate IT to raise identity-verification requirements.

3) Handling privacy and biometric exposure. Gallery content, ID photographs, facial images and chat history cannot be "rotated" once out. Scope what left the device and act on that: add manual verification to financial and government accounts, expect follow-on extortion and impersonation attempts built on the stolen material, and preserve evidence for a police report where appropriate.

4) Cloud and external copies. Realistic file recovery almost always lives off the device: cloud photo and backup version history, desktop sync copies, standalone messenger backups, and files previously sent to others. On Android 10 and later, Scoped Storage often leaves encryption incomplete, so app-private directories and several paths commonly survive intact.

5) Device forensics and low-level recovery. TRIM and flash garbage collection make deleted originals unrecoverable quickly, so the sooner the device stops being used, the more remains. Where forensic acquisition is possible, imaging followed by carving can be attempted, but yields are typically low and it should not be the primary expectation.

We deliver a verifiable impact assessment and a clearly bounded scope of work. We never claim "100% decryption", and no technique guarantees full recovery.

Our response plan

Hit by Mantax Otax ransomware? What to do

  1. Isolate the device and preserve its state

    Put the infected phone into airplane mode and disable Wi-Fi at once to cut C2 traffic and exfiltration. Do not factory reset, reflash or uninstall the suspicious app - all three destroy the .enc files and the forensic evidence together. Enter no password, PIN or verification code on that device. Move every subsequent action on affected accounts to a separate, confirmed-clean device, and retain the malicious APK if it is still in the downloads folder, screenshots of the lock screen, and a few .enc sample files.

  2. Family identification and sample analysis

    Confirm Mantax Otax from the extension, the wording of the lock screen and chat window, package metadata and observed behaviour, then separate build one from build two (HTTPS versus WebSocket, presence of the app-blocking and harassment modules). Because .enc is generic, attribution must come from the sample, not the suffix. In parallel, establish which permissions were granted, which directories were touched and what data categories were transmitted - that scope bounds everything in the next step.

  3. Assess account exposure and encryption scope

    Two tracks in parallel. First, credential and privacy exposure: enumerate the banking, payment, social, corporate mail and OA accounts bound to that phone, review sign-in history and third-party authorisations for each, determine which SMS second factors were likely intercepted, and scope the exposure of ID photographs, facial imagery and chat history in the gallery. Second, encryption scope: judge from the Android version whether Scoped Storage constrained the encryptor, inventory which directories were hit and which survived, and confirm the usable restore points in cloud backups and desktop sync copies.

  4. Containment and data recovery

    Execute in priority order. On the clean device first: suspend or replace the SIM, freeze accounts, reset passwords, revoke sessions and connected applications, and switch second factors away from SMS. Then move to data: restore from cloud photo services, device backups, desktop sync copies and messenger backups, and export in full whatever directories on the device escaped encryption. No speculative decryption is attempted against .enc files. All work happens on copies, with the original device kept offline and read-only for any later forensic need.

  5. Attribution, hardening and handover

    Reconstruct the full path: which link and channel delivered the APK, when device administrator and Accessibility were granted, what data left the device, and whether corporate accounts were touched. On the device, revoke device administrator rights first, then fully reinstall the system and restore from a trusted backup - do not reinstall the old app set as-is. On the corporate side, harden BYOD: disable unknown-source installation, deploy mobile threat defence and MDM, limit what personal devices can reach in OA and mail, move corporate second factors from SMS to authenticators or hardware keys, and brief staff on the specific social-engineering pattern used. Close with an incident report and a formal handover checklist.

Risk warning

What not to do

  • Do not enter the screen-lock PIN, banking passwords or SMS codes on the infected phone - the fake "administrative lock" screen exists precisely to harvest the PIN. Every account action belongs on a separate clean device.
  • Do not rush to factory reset, reflash or uninstall the suspicious app; that destroys the .enc files, the exfiltration traces and the forensic evidence in one move, leaving no basis for impact assessment.
  • Do not download and trial ".enc decryptors" found online. The suffix is shared by several families, and a mismatched tool only damages the files further.
  • Do not talk to the operator in the in-app chat window or pay. Payment neither guarantees a key nor recalls the gallery images, ID photographs and chat history already exfiltrated.
  • Do not reconnect the infected phone to corporate Wi-Fi or VPN, or sign back into corporate mail and OA from it, or a personal-device infection becomes a corporate account compromise.
  • Do not treat "nothing was encrypted" as the all-clear - on Android 10 and later the files may be intact while the theft of one-time passcodes, contacts and photos has already happened, and it must still be handled as a data breach.

Emergency response

Data already encrypted? Stop and let an engineer look first

We do not pay ransoms and we do not negotiate with attackers. Engineers run a free assessment first, then propose a recovery plan and a firm quote.

+86 15639272850See contact details

Related scenarios

Related industries

Similar families

FAQ

Mantax Otax Frequently asked questions

  • My phone files were renamed to .enc - can they be decrypted?

    For Mantax Otax specifically, there is no viable direct decryption path today. Its AES key is issued per device by the C2 against the Android ID, nothing usable stays on the phone, no exploitable flaw has been published, and we found no tool on No More Ransom or in the vendor toolkits we checked.

    The realistic recovery routes are off-device: cloud photo and backup version history, desktop sync copies, messenger backups, and files previously shared with others. Note too that .enc is a generic suffix used by several families and by legitimate encryption software, so identify the family from samples before attempting anything - and never trial an unknown ".enc decryptor" on the original phone.

  • Can I just factory reset the phone?

    Not before an assessment. A reset does remove the app, but it simultaneously destroys three things: deleted originals that forensics might still recover, the .enc files themselves, and the evidence of what was exfiltrated. Without that last item there is no basis for deciding which accounts to freeze or how far notification has to reach.

    The right order is: airplane mode first, preserve the device and run the impact assessment, complete account freezes and credential rotation from a separate clean device, and only once the needed data and evidence are secured, revoke device administrator rights, fully reinstall the system and restore from a trusted backup.

  • The phone is locked behind an overlay with constant pop-ups - how do I handle it safely?

    Build two uses transparent overlays to swallow touch input, blocks selected apps, spams dialogs, plays full-screen video and flashed images, and reads threats aloud via text-to-speech. All of it is designed to panic the victim into paying quickly.

    What to do: first, hold the power button to enter airplane mode, or otherwise switch off mobile data and Wi-Fi - cutting the command channel disables most of the harassment. Second, do not enter the PIN when prompted. Third, try booting into safe mode (on most Android devices, long-press the "Power off" option), where third-party apps do not auto-start, then revoke the app's device administrator rights in Settings and uninstall it. Fourth, if device administrator rights cannot be revoked or the UI is fully hijacked, do not keep reflashing - contact incident response for forensic handling.

  • If SMS codes were intercepted, can corporate accounts be taken over?

    Yes, and this is the part of a Mantax Otax incident that deserves priority. The malware reads SMS and notifications, steals the screen-lock PIN, harvests contacts and Google account details, and uses Accessibility to read WhatsApp and Telegram content. Any account relying on SMS as its second factor should be assumed bypassable.

    From a separate clean device, immediately: suspend or replace the SIM; reset the passwords for mail, OA, VPN and banking accounts tied to that number; revoke all active sessions and third-party authorisations; move corporate second factors from SMS to an authenticator or hardware key; and have IT review recent sign-in locations plus persistence-style settings such as mail forwarding and delegation rules.

  • An employee's personal phone is infected - what should the company do?

    Treat it as a corporate data exposure caused by a personal device, not as the employee's private problem. Start by establishing what the phone could reach: mail, OA, VPN, messaging, internal documents, and whether it received verification codes for corporate accounts.

    Then reset all of that employee's corporate credentials, revoke device trust and active sessions, and review the relevant accounts for anomalous sign-ins and rule changes. Scope which corporate files, meeting notes and screenshots stored on the phone may have left, and use that to judge internal notification and any contractual or regulatory obligations. Longer term, close the BYOD gap: limit what personal devices can access, deploy mobile threat defence and MDM, and move second-factor authentication to authenticators or hardware keys. We run 24/7 emergency response and can return a family assessment, exposure scope and prioritised action list shortly after remote access.

Sources

External links are provided for reference only. The content is published by third parties and does not represent our position.

Updated