Frame-14

Privacy Ninja

        • DATA PROTECTION

        • Email Spoofing Prevention
        • Check if your organization email is vulnerable to hackers and put a stop to it. Receive your free test today!
        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • AntiHACK Phone
        • Boost your smartphone’s security with enterprise-level encryption, designed by digital forensics and counterintelligence experts, guaranteeing absolute privacy for you and up to 31 others, plus a guest user, through exclusive access.

        • CYBERSECURITY

        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$3,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Secure your digital frontiers with our API penetration testing service, meticulously designed to identify and fortify vulnerabilities, ensuring robust protection against cyber threats.

        • Network Penetration Testing
        • Strengthen your network’s defenses with our comprehensive penetration testing service, tailored to uncover and seal security gaps, safeguarding your infrastructure from cyber attacks.

        • Mobile Penetration Testing
        • Strengthen your network’s defenses with our comprehensive penetration testing service, tailored to uncover and seal security gaps, safeguarding your infrastructure from cyber attacks.

        • Web Penetration Testing
        • Fortify your web presence with our specialized web penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats.

        • RAPID DIGITALISATION

        • OTHERS

Google: Predator Spyware Infected Android Devices Using zero-days

Google: Predator Spyware Infected Android Devices Using zero-days

Google’s Threat Analysis Group (TAG) says that state-backed threat actors used five zero-day vulnerabilities to install Predator spyware developed by commercial surveillance developer Cytrox.

In these attacks, part of three campaigns that started between August and October 2021, the attackers used zero-day exploits targeting Chrome and the Android OS to install Predator spyware implants on fully up-to-date Android devices.

“We assess with high confidence that these exploits were packaged by a single commercial surveillance company, Cytrox, and sold to different government-backed actors who used them in at least the three campaigns discussed below,” said Google TAG members Clement Lecigne and Christian Resell.

Also Read: Cybersecurity in 2022: What businesses should know

The government-backed malicious actors who purchased and used these exploits to infect Android targets with spyware are from Egypt, Armenia, Greece, Madagascar, Côte d’Ivoire, Serbia, Spain, and Indonesia, according to Google’s analysis.

These findings align with a report on Cytrox mercenary spyware published by CitizenLab in December 2021, when its researchers discovered the malicious tool on the phone of exiled Egyptian politician Ayman Nour.

Nour’s phone was also infected with NSO Group’s Pegasus spyware, with the two tools being operated by two different government clients per CitizenLab’s assessment.

Zero-days exploited in three campaigns targeting Android users

The five previously unknown 0-day security vulnerabilities used in these campaigns include:

The threat actors deployed exploits targeting these zero-days in three separate campaigns:

  • Campaign #1 – redirecting to SBrowser from Chrome (CVE-2021-38000)
  • Campaign #2 – Chrome sandbox escape (CVE-2021-37973, CVE-2021-37976)
  • Campaign #3 – Full Android 0-day exploit chain (CVE-2021-38003, CVE-2021-1048)

“All three campaigns delivered one-time links mimicking URL shortener services to the targeted Android users via email. The campaigns were limited — in each case, we assess the number of targets was in the tens of users,” the Google TAG analysts added.

“Once clicked, the link redirected the target to an attacker-owned domain that delivered the exploits before redirecting the browser to a legitimate website. If the link was not active, the user was redirected directly to a legitimate website.”

This attack technique was also used against journalists and other Google users who were alerted that they were the target of government-backed attacks.

Shane Huntley Cytrox tweet

Spyware implant dropped using Android banking trojan

In these campaigns, the attackers first installed the Android Alien banking trojan with RAT functionality used to load the Predator Android implant, allowing recording audio, adding CA certificates, and hiding apps.

Also Read: Exploring the dangers of game scams on children

This report is a follow-up to a July 2021 analysis of four other 0-day flaws discovered in 2021 in Chrome, Internet Explorer, and WebKit (Safari).

As Google TAG researchers revealed, Russian-backed government hackers linked to the Russian Foreign Intelligence Service (SVR) exploited the Safari zero-day to target iOS devices belonging to government officials from western European countries.

“TAG is actively tracking more than 30 vendors with varying levels of sophistication and public exposure selling exploits or surveillance capabilities to government-backed actors,” Google TAG added on Thursday.

0 Comments

KEEP IN TOUCH

Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection

REPORTING DATA BREACH TO PDPC?

We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.
×

Hello!

Click one of our contacts below to chat on WhatsApp

× Chat with us