Found 174 bookmarks
Custom sorting
Mercenary mayhem: A technical analysis of Intellexa's PREDATOR spyware
Mercenary mayhem: A technical analysis of Intellexa's PREDATOR spyware
We would like to thank The Citizen Lab for their cooperation, support and inputs into this research. * Commercial spyware use is on the rise, with actors leveraging these sophisticated tools to conduct surveillance operations against a growing number of targets. Cisco Talos has new details of a commercial spyware product sold by the spyware firm Intellexa (formerly known as Cytrox). * Our research specifically looks at two components of this mobile spyware suite known as “ALIEN” and “PREDATOR,” which compose the backbone of the spyware implant. Our findings include an in-depth walkthrough of the infection chain, including the implants’ various information-stealing capabilities. * A deep dive into both spyware components indicates that ALIEN is more than just a loader for PREDATOR and actively sets up the low-level capabilities needed for PREDATOR to spy on its victims. * We assess with high confidence that the spyware has two additional components — tcore (main component) and kmem (privilege escalation mechanic) — but we were unable to obtain and analyze these modules. * If readers suspect their system(s) may have been compromised by commercial spyware, please consider notifying Talos’ research team at talos-mercenary-spyware-help@external.cisco.com to assist in furthering the community’s knowledge of these threats.
#talosintelligence#EN#2023#PREDATOR#spyware#Intellexa#ALIEN#analysis#Android
·blog.talosintelligence.com·
Mercenary mayhem: A technical analysis of Intellexa's PREDATOR spyware
Inner workings revealed for “Predator,” the Android malware that exploited 5 0-days
Inner workings revealed for “Predator,” the Android malware that exploited 5 0-days
Spyware is sold to countries including Egypt, Indonesia, Oman, Saudi Arabia, and Serbia. Smartphone malware sold to governments around the world can surreptitiously record voice calls and nearby audio, collect data from apps such as Signal and WhatsApp, and hide apps or prevent them from running upon device reboots, researchers from Cisco’s Talos security team have found.
#arstechnica#EN#2023#Smartphone#PREDATOR#0-days#spyware#Android
·arstechnica.com·
Inner workings revealed for “Predator,” the Android malware that exploited 5 0-days
DEV-0196: QuaDream’s “KingsPawn” malware used to target civil society in Europe, North America, the Middle East, and Southeast Asia
DEV-0196: QuaDream’s “KingsPawn” malware used to target civil society in Europe, North America, the Middle East, and Southeast Asia
Microsoft analyzes a threat group tracked as DEV-0196, the actor’s iOS malware “KingsPawn”, and their link to an Israel-based private sector offensive actor (PSOA) known as QuaDream, which reportedly sells a suite of exploits, malware, and infrastructure called REIGN, that’s designed to exfiltrate data from mobile devices.
#microsoft#EN#2023#QuaDream#spyware#spy#IoCs#DEV-0196#iOS#calendar#zero-click#REIGN
·microsoft.com·
DEV-0196: QuaDream’s “KingsPawn” malware used to target civil society in Europe, North America, the Middle East, and Southeast Asia
Sweet QuaDreams: A First Look at Spyware Vendor QuaDream’s Exploits, Victims, and Customers - The Citizen Lab
Sweet QuaDreams: A First Look at Spyware Vendor QuaDream’s Exploits, Victims, and Customers - The Citizen Lab
At least five civil society victims of QuaDream’s spyware and exploits were identified in North America, Central Asia, Southeast Asia, Europe, and the Middle East. Victims include journalists, political opposition figures, and an NGO worker. Traces of a suspected iOS 14 zero-click exploit used to deploy QuaDream’s spyware.
#CitizenLab#EN#2023#QuaDreams#Spyware#spyware#spy#iPhone#calendar#zero-click
·citizenlab.ca·
Sweet QuaDreams: A First Look at Spyware Vendor QuaDream’s Exploits, Victims, and Customers - The Citizen Lab
Spyware vendors use 0-days and n-days against popular platforms
Spyware vendors use 0-days and n-days against popular platforms
Google’s Threat Analysis Group (TAG) tracks actors involved in information operations (IO), government backed attacks and financially motivated abuse. For years, TAG has been tracking the activities of commercial spyware vendors to protect users. Today, we actively track more than 30 vendors with varying levels of sophistication and public exposure selling exploits or surveillance capabilities to government backed actors. These vendors are enabling the proliferation of dangerous hacking tools, arming governments that would not be able to develop these capabilities in-house. While use of surveillance technologies may be legal under national or international laws, they are often found to be used by governments to target dissidents, journalists, human rights workers and opposition party politicians.
#GoogleTAG#EN#2023#0-days#Spyware#Italy#Malaysia#Kazakhstan#CVE-2022-42856#Webkit#Samsung#CVE-2022-4262#CVE-2023-0266
·blog.google·
Spyware vendors use 0-days and n-days against popular platforms
Meta Manager Was Hacked With Spyware and Wiretapped in Greece
Meta Manager Was Hacked With Spyware and Wiretapped in Greece
A U.S. and Greek national who worked on Meta’s security and trust team while based in Greece was placed under a yearlong wiretap by the Greek national intelligence service and hacked with a powerful cyberespionage tool, according to documents obtained by The New York Times and officials with knowledge of the case.
#nytimes#EN#2023#spy#cyberespionage#U.S#Meta#Spyware#Predator
·nytimes.com·
Meta Manager Was Hacked With Spyware and Wiretapped in Greece
Logiciels espions et surveillance : un rapport de l’ONU met en garde contre les menaces croissantes pour la vie privée et les droits de l’homme
Logiciels espions et surveillance : un rapport de l’ONU met en garde contre les menaces croissantes pour la vie privée et les droits de l’homme
Le droit à la vie privée est de plus en plus menacé par l’utilisation de technologies numériques modernes en réseau, dont les caractéristiques en font de formidables outils de surveillance, de contrôle et d’oppression, selon un nouveau rapport de l’ONU. Il est donc essentiel que ces technologies soient encadrées par une réglementation efficace reposant sur le droit international des droits de l’homme et les normes applicables en la matière PDF Document link
#OHCHR#ONU#FR#2022#surveillance#espion#spyware#Pegasus#rapport
·ohchr.org·
Logiciels espions et surveillance : un rapport de l’ONU met en garde contre les menaces croissantes pour la vie privée et les droits de l’homme
Revealing Europe's NSO
Revealing Europe's NSO
An Italian surveillance company is tracking people all over the world on a grand scale on behalf of its clients – including in countries with a recent history of corruption and human rights abuses. Its powerful spyware was recently found in Kazakhstan and Romania. Europe’s parliamentarians voice growing concern about an out-of-control surveillance industry and call for it to be regulated.
#lighthousereports#EN#2022#Investigation#Tykelab#Hermit#spyware
·lighthousereports.nl·
Revealing Europe's NSO
Untangling KNOTWEED: European private-sector offensive actor using 0-day exploits
Untangling KNOTWEED: European private-sector offensive actor using 0-day exploits
MSTIC and MSRC disclose technical details of a private-sector offensive actor (PSOA) tracked as KNOTWEED using multiple Windows and Adobe 0-day exploits, including one for the recently patched CVE-2022-22047, in limited and targeted attacks against European and Central American customers.
#microsoft#EN#2022#KNOTWEED#0day#0-day#CVE-2022-22047#spyware#PSOA
·microsoft.com·
Untangling KNOTWEED: European private-sector offensive actor using 0-day exploits
The Return of Candiru: Zero-days in the Middle East - Avast Threat Labs
The Return of Candiru: Zero-days in the Middle East - Avast Threat Labs
We recently discovered a zero-day vulnerability in Google Chrome (CVE-2022-2294) when it was exploited in the wild in an attempt to attack Avast users in the Middle East. The vulnerability was a memory corruption in WebRTC that was abused to achieve shellcode execution in Chrome’s renderer process. We reported this vulnerability to Google, who patched it on July 4, 2022.
#avast#EN#2022#Candiru#spyware#CVE-2022-2294#webRTC
·decoded.avast.io·
The Return of Candiru: Zero-days in the Middle East - Avast Threat Labs
Lookout Découverte d'un logiciel espion Android déployé au Kazakhstan
Lookout Découverte d'un logiciel espion Android déployé au Kazakhstan
Lookout Les chercheurs de Threat Lab ont découvert un logiciel de surveillance Android de niveau entreprise utilisé par le gouvernement du Kazakhstan à l'intérieur de ses frontières. D'après notre analyse, le logiciel espion est probablement développé par le fournisseur italien de logiciels espions RCS Lab S.p.A.
#lookout#FR#2022#surveillance#spyware#Android#rcslab#Italie#Italy#Kazakhstan#Hermit
·fr.lookout.com·
Lookout Découverte d'un logiciel espion Android déployé au Kazakhstan
Takedown of SMS-based FluBot spyware infecting Android phones
Takedown of SMS-based FluBot spyware infecting Android phones
This technical achievement follows a complex investigation involving law enforcement authorities of Australia, Belgium, Finland, Hungary, Ireland, Spain, Sweden, Switzerland, the Netherlands and the United States, with the coordination of international activity carried out by Europol’s European Cybercrime Centre (EC3).  The investigation is ongoing to identify the individuals behind this global malware campaign.  Here is how FluBot worked  First spotted...
#FluBot#europol#Takedown#SMS-based#Android#EN#2022#spyware
·europol.europa.eu·
Takedown of SMS-based FluBot spyware infecting Android phones
Pegasus vs. Predator: Dissident's Doubly-Infected iPhone Reveals Cytrox Mercenary Spyware
Pegasus vs. Predator: Dissident's Doubly-Infected iPhone Reveals Cytrox Mercenary Spyware
Two Egyptians—exiled politician Ayman Nour and the host of a popular news program (who wishes to remain anonymous)—were hacked with Predator spyware, built and sold by the previously little-known mercenary spyware developer Cytrox. The phone of Ayman Nour was simultaneously infected with both Cytrox’s Predator and NSO Group’s Pegasus spyware, operated by two different government clients.
#citizenlab#2021#EN#Pegasus#Predator#spyware#privacy#IoC#Cytrox
·citizenlab.ca·
Pegasus vs. Predator: Dissident's Doubly-Infected iPhone Reveals Cytrox Mercenary Spyware