Found 163 bookmarks
Custom sorting
The Return of Candiru: Zero-days in the Middle East - Avast Threat Labs
The Return of Candiru: Zero-days in the Middle East - Avast Threat Labs
We recently discovered a zero-day vulnerability in Google Chrome (CVE-2022-2294) when it was exploited in the wild in an attempt to attack Avast users in the Middle East. The vulnerability was a memory corruption in WebRTC that was abused to achieve shellcode execution in Chrome’s renderer process. We reported this vulnerability to Google, who patched it on July 4, 2022.
#avast#EN#2022#Candiru#spyware#CVE-2022-2294#webRTC
·decoded.avast.io·
The Return of Candiru: Zero-days in the Middle East - Avast Threat Labs
Pegasus vs. Predator: Dissident's Doubly-Infected iPhone Reveals Cytrox Mercenary Spyware
Pegasus vs. Predator: Dissident's Doubly-Infected iPhone Reveals Cytrox Mercenary Spyware
Two Egyptians—exiled politician Ayman Nour and the host of a popular news program (who wishes to remain anonymous)—were hacked with Predator spyware, built and sold by the previously little-known mercenary spyware developer Cytrox. The phone of Ayman Nour was simultaneously infected with both Cytrox’s Predator and NSO Group’s Pegasus spyware, operated by two different government clients.
#citizenlab#2021#EN#Pegasus#Predator#spyware#privacy#IoC#Cytrox
·citizenlab.ca·
Pegasus vs. Predator: Dissident's Doubly-Infected iPhone Reveals Cytrox Mercenary Spyware
CatalanGate: Extensive Mercenary Spyware Operation against Catalans Using Pegasus and Candiru
CatalanGate: Extensive Mercenary Spyware Operation against Catalans Using Pegasus and Candiru
The Citizen Lab, in collaboration with Catalan civil society groups, has identified at least 65 individuals targeted or infected with mercenary spyware, including members of the European Parliament, Catalan Presidents, legislators, jurists, and members of civil society organisations.
#citizenlab#CatalanGate#EN#2022#Pagasus#Catalan#spyware#EU
·citizenlab.ca·
CatalanGate: Extensive Mercenary Spyware Operation against Catalans Using Pegasus and Candiru
‘Zero-Click’ Hacks Are Growing in Popularity. There’s Practically No Way to Stop Them
‘Zero-Click’ Hacks Are Growing in Popularity. There’s Practically No Way to Stop Them
As a journalist working for the Arab news network Alaraby, Rania Dridi said she’s taken precautions to avoid being targeted by hackers, keeping an eye out for suspicious messages and avoiding clicking on links or opening attachments from people she doesn’t know.
#Bloomberg#EN#2022#zeroclick#spyware#NSO#governement#spy#privacy#attack
·bloombergquint.com·
‘Zero-Click’ Hacks Are Growing in Popularity. There’s Practically No Way to Stop Them
Spyware Targeting Against Serbian Civil Society - The Citizen Lab
Spyware Targeting Against Serbian Civil Society - The Citizen Lab
We confirm that two members of Serbian civil society were targeted with spyware earlier this year. Both have publicly criticized the Serbian government. We are not naming the individuals at this time by their request. The Citizen Lab’s technical analysis of forensic artifacts was conducted in support of an investigation led by Access Now in collaboration with the SHARE Foundation. Researchers from Amnesty International independently analyzed the cases and their conclusions match our findings.
#CitizenLab#EN#2023#Serbia#Pegasus#spyware#homekit#iOS
·citizenlab.ca·
Spyware Targeting Against Serbian Civil Society - The Citizen Lab
The Return of Candiru: Zero-days in the Middle East - Avast Threat Labs
The Return of Candiru: Zero-days in the Middle East - Avast Threat Labs
We recently discovered a zero-day vulnerability in Google Chrome (CVE-2022-2294) when it was exploited in the wild in an attempt to attack Avast users in the Middle East. The vulnerability was a memory corruption in WebRTC that was abused to achieve shellcode execution in Chrome’s renderer process. We reported this vulnerability to Google, who patched it on July 4, 2022.
#avast#EN#2022#Candiru#spyware#CVE-2022-2294#webRTC
·decoded.avast.io·
The Return of Candiru: Zero-days in the Middle East - Avast Threat Labs
Pegasus vs. Predator: Dissident's Doubly-Infected iPhone Reveals Cytrox Mercenary Spyware
Pegasus vs. Predator: Dissident's Doubly-Infected iPhone Reveals Cytrox Mercenary Spyware
Two Egyptians—exiled politician Ayman Nour and the host of a popular news program (who wishes to remain anonymous)—were hacked with Predator spyware, built and sold by the previously little-known mercenary spyware developer Cytrox. The phone of Ayman Nour was simultaneously infected with both Cytrox’s Predator and NSO Group’s Pegasus spyware, operated by two different government clients.
#citizenlab#2021#EN#Pegasus#Predator#spyware#privacy#IoC#Cytrox
·citizenlab.ca·
Pegasus vs. Predator: Dissident's Doubly-Infected iPhone Reveals Cytrox Mercenary Spyware
CatalanGate: Extensive Mercenary Spyware Operation against Catalans Using Pegasus and Candiru
CatalanGate: Extensive Mercenary Spyware Operation against Catalans Using Pegasus and Candiru
The Citizen Lab, in collaboration with Catalan civil society groups, has identified at least 65 individuals targeted or infected with mercenary spyware, including members of the European Parliament, Catalan Presidents, legislators, jurists, and members of civil society organisations.
#citizenlab#CatalanGate#EN#2022#Pagasus#Catalan#spyware#EU
·citizenlab.ca·
CatalanGate: Extensive Mercenary Spyware Operation against Catalans Using Pegasus and Candiru
‘Zero-Click’ Hacks Are Growing in Popularity. There’s Practically No Way to Stop Them
‘Zero-Click’ Hacks Are Growing in Popularity. There’s Practically No Way to Stop Them
As a journalist working for the Arab news network Alaraby, Rania Dridi said she’s taken precautions to avoid being targeted by hackers, keeping an eye out for suspicious messages and avoiding clicking on links or opening attachments from people she doesn’t know.
#Bloomberg#EN#2022#zeroclick#spyware#NSO#governement#spy#privacy#attack
·bloombergquint.com·
‘Zero-Click’ Hacks Are Growing in Popularity. There’s Practically No Way to Stop Them
PREDATOR IN THE WIRES: Ahmed Eltantawy Targeted with Predator Spyware After Announcing Presidential Ambitions
PREDATOR IN THE WIRES: Ahmed Eltantawy Targeted with Predator Spyware After Announcing Presidential Ambitions
Between May and September 2023, former Egyptian MP Ahmed Eltantawy was targeted with Cytrox's Predator spyware via links sent on SMS and WhatsApp after Eltantawy publicly stated his plans to run for President in the 2024 Egyptian elections. As Egypt is a known customer of Cytrox's Predator spyware, and the spyware was delivered via network injection from a device located physically inside Egypt, we attribute the attack to the Egyptian government with high confidence.
#CitizenLab#EN#2023#spyware#Egypt#Predator#CVE-2023-41991#CVE-2023-41992#CVE-2023-41993
·citizenlab.ca·
PREDATOR IN THE WIRES: Ahmed Eltantawy Targeted with Predator Spyware After Announcing Presidential Ambitions
0-days exploited by commercial surveillance vendor in Egypt
0-days exploited by commercial surveillance vendor in Egypt
Last week Google’s Threat Analysis Group (TAG), in partnership with The Citizen Lab, discovered an in-the-wild 0-day exploit chain for iPhones. Developed by the commercial surveillance vendor, Intellexa, this exploit chain is used to install its Predator spyware surreptitiously onto a device. In response, yesterday, Apple patched the bugs in iOS 16.7 and iOS 17.0.1 as CVE-2023-41991, CVE-2023-41992, CVE-2023-41993. This quick patching from Apple helps to better protect users and we encourage all iOS users to install them as soon as possible.
#Google#EN#2023#TAG#Apple#Android#CitizenLab#Predator#spyware#Intellexa#CVE-2023-41993#CVE-2023-41991#CVE-2023-41992#Exploit#Chain#0-days
·blog.google·
0-days exploited by commercial surveillance vendor in Egypt
The Return of Candiru: Zero-days in the Middle East - Avast Threat Labs
The Return of Candiru: Zero-days in the Middle East - Avast Threat Labs
We recently discovered a zero-day vulnerability in Google Chrome (CVE-2022-2294) when it was exploited in the wild in an attempt to attack Avast users in the Middle East. The vulnerability was a memory corruption in WebRTC that was abused to achieve shellcode execution in Chrome’s renderer process. We reported this vulnerability to Google, who patched it on July 4, 2022.
#avast#EN#2022#Candiru#spyware#CVE-2022-2294#webRTC
·decoded.avast.io·
The Return of Candiru: Zero-days in the Middle East - Avast Threat Labs
Pegasus vs. Predator: Dissident's Doubly-Infected iPhone Reveals Cytrox Mercenary Spyware
Pegasus vs. Predator: Dissident's Doubly-Infected iPhone Reveals Cytrox Mercenary Spyware
Two Egyptians—exiled politician Ayman Nour and the host of a popular news program (who wishes to remain anonymous)—were hacked with Predator spyware, built and sold by the previously little-known mercenary spyware developer Cytrox. The phone of Ayman Nour was simultaneously infected with both Cytrox’s Predator and NSO Group’s Pegasus spyware, operated by two different government clients.
#citizenlab#2021#EN#Pegasus#Predator#spyware#privacy#IoC#Cytrox
·citizenlab.ca·
Pegasus vs. Predator: Dissident's Doubly-Infected iPhone Reveals Cytrox Mercenary Spyware
CatalanGate: Extensive Mercenary Spyware Operation against Catalans Using Pegasus and Candiru
CatalanGate: Extensive Mercenary Spyware Operation against Catalans Using Pegasus and Candiru
The Citizen Lab, in collaboration with Catalan civil society groups, has identified at least 65 individuals targeted or infected with mercenary spyware, including members of the European Parliament, Catalan Presidents, legislators, jurists, and members of civil society organisations.
#citizenlab#CatalanGate#EN#2022#Pagasus#Catalan#spyware#EU
·citizenlab.ca·
CatalanGate: Extensive Mercenary Spyware Operation against Catalans Using Pegasus and Candiru
‘Zero-Click’ Hacks Are Growing in Popularity. There’s Practically No Way to Stop Them
‘Zero-Click’ Hacks Are Growing in Popularity. There’s Practically No Way to Stop Them
As a journalist working for the Arab news network Alaraby, Rania Dridi said she’s taken precautions to avoid being targeted by hackers, keeping an eye out for suspicious messages and avoiding clicking on links or opening attachments from people she doesn’t know.
#Bloomberg#EN#2022#zeroclick#spyware#NSO#governement#spy#privacy#attack
·bloombergquint.com·
‘Zero-Click’ Hacks Are Growing in Popularity. There’s Practically No Way to Stop Them
A Matter of Triangulation.
A Matter of Triangulation.
Hi all, Today we have very big and important news. Kaspersky experts have discovered an extremely complex, professionally targeted cyberattack that uses Apple’s mobile devices. The purpose of this attack is the inconspicuous introduction of spyware into the iPhones of employees of the company – both top and middle-management. The attack is carried out using
#kaspersky#EN#2023#iOS#0-Click#Triangulation#iphone#spyware#Apple
·eugene.kaspersky.com·
A Matter of Triangulation.
Mercenary mayhem: A technical analysis of Intellexa's PREDATOR spyware
Mercenary mayhem: A technical analysis of Intellexa's PREDATOR spyware
We would like to thank The Citizen Lab for their cooperation, support and inputs into this research. * Commercial spyware use is on the rise, with actors leveraging these sophisticated tools to conduct surveillance operations against a growing number of targets. Cisco Talos has new details of a commercial spyware product sold by the spyware firm Intellexa (formerly known as Cytrox). * Our research specifically looks at two components of this mobile spyware suite known as “ALIEN” and “PREDATOR,” which compose the backbone of the spyware implant. Our findings include an in-depth walkthrough of the infection chain, including the implants’ various information-stealing capabilities. * A deep dive into both spyware components indicates that ALIEN is more than just a loader for PREDATOR and actively sets up the low-level capabilities needed for PREDATOR to spy on its victims. * We assess with high confidence that the spyware has two additional components — tcore (main component) and kmem (privilege escalation mechanic) — but we were unable to obtain and analyze these modules. * If readers suspect their system(s) may have been compromised by commercial spyware, please consider notifying Talos’ research team at talos-mercenary-spyware-help@external.cisco.com to assist in furthering the community’s knowledge of these threats.
#talosintelligence#EN#2023#PREDATOR#spyware#Intellexa#ALIEN#analysis#Android
·blog.talosintelligence.com·
Mercenary mayhem: A technical analysis of Intellexa's PREDATOR spyware
Inner workings revealed for “Predator,” the Android malware that exploited 5 0-days
Inner workings revealed for “Predator,” the Android malware that exploited 5 0-days
Spyware is sold to countries including Egypt, Indonesia, Oman, Saudi Arabia, and Serbia. Smartphone malware sold to governments around the world can surreptitiously record voice calls and nearby audio, collect data from apps such as Signal and WhatsApp, and hide apps or prevent them from running upon device reboots, researchers from Cisco’s Talos security team have found.
#arstechnica#EN#2023#Smartphone#PREDATOR#0-days#spyware#Android
·arstechnica.com·
Inner workings revealed for “Predator,” the Android malware that exploited 5 0-days