Midnight Mimosa is embedded in the firmware of some low-cost Android devices and can turn them into attacker-controlled proxy nodes. GajIPS detects the malware’s network activity and proxy registration
Severity: High | Priority: 2
This GajIPS update adds network-layer detection for Midnight Mimosa. The malware is built into the firmware of low-cost Android phones using MediaTek chipsets. It runs with system-level privileges, so it can install and remove apps, grant sensitive permissions and run remotely downloaded code without the user doing anything. Affected devices include models sold under legitimate brand names, such as the Doogee S200 X and Cubot KINGKONG X, and phones that impersonate Samsung and Apple products.
If alerts trigger in your network, the source address is almost certainly an Android phone or tablet carrying Midnight Mimosa, most often a personal or low-cost device on corporate or guest Wi-Fi. The proxy registration alert matters most: it means the device has enrolled in an attacker-controlled proxy network. Outsiders could then send traffic out through your internet connection, or use the device as a foothold to reach internal systems on the same network segment.
Respond as follows: