A new mobile spyware platform called ZeroDayRAT, claimed to provide full remote control over compromised Android and iOS devices, is being sold openly via Telegram.

According to analysis from iVerify, developers behind the tool run dedicated channels for sales and customer support and give regular updates. Buyers are given a single point of access to a fully operational spyware panel, with full remote control over a user’s Android or iOS device.

Support covers Android 5 through 16 and iOS up to 26, including the iPhone 17 Pro. No technical expertise is required, researchers warned.

"Taken together, this is a complete mobile compromise toolkit, the kind that used to require nation-state investment or bespoke exploit development, now sold on Telegram," the researchers said.

"A single buyer gets full access to a target’s location, messages, finances, camera, microphone, and keystrokes from a browser tab. Cross-platform support and active development make it a growing threat to both individuals and organizations."

How ZeroDayRAT attacks work

Attacks generally start with smishing, researchers said. The victim gets a text with a link, downloads what looks like a legitimate app, and installs it. Phishing emails, fake app stores, and links shared over WhatsApp or Telegram are also being used.

Once a device is infected, the attacker can use an overview tab showing the device model, OS, battery, country, lock status, and SIM and carrier info.

Similarly, dual SIM phone numbers, app usage broken down by time, a live activity timeline, and a preview of recent SMS messages are all displayed on a single screen.

"This screen is enough to profile the infected user: who they talk to, what apps they use most, when they're active, and what network they're on," researchers said. "Scrolling down reveals intercepted messages from banking services, carriers, and personal contacts."

GPS coordinates are pulled and plotted on an embedded Google Maps view with location history, so an operator can track not just where the infected user is, but where they've been.

Notifications - app name, title, content, and timestamp. WhatsApp messages, Instagram notifications, missed calls, Telegram updates, YouTube alerts and system events - are also captured.

Follow-up compromise is a real risk

Notably, an accounts tab enumerates every account registered on the device, such as Google, WhatsApp, Instagram, Facebook, Telegram, Amazon, and Spotify accounts associated with usernames or emails.

This, researchers warned, is basically everything an attacker needs to attempt account takeover or launch targeted social engineering.

"ZeroDayRAT shows how easily an attacker can gain full, real‑time visibility into a mobile device, exposing far more than personal information," commented Matthew Stern, chief security Officer at Hypori.

"The only reliable protection is removing trust from the physical device entirely. By keeping confidential data off the endpoint, organizations ensure that even if spyware takes full control of a device, sensitive information is not accessible.”

FOLLOW US ON SOCIAL MEDIA

A former Facebook employee in Greece, a US national, was allegedly placed under a wiretap by the country’s national intelligence service through Predator spyware.

Artemis Seaford worked for Facebook between 2020 and 2022 as a trust and safety manager in Greece. She became suspicious of a potential hack after spotting her name on a leaked list of spyware targets in the Greek news media, according to the New York Times which first reported the story.

She worked on cyber security policy and was in contact with Greek and European officials during her role.

After realising her details were leaked, Seaford submitted her mobile phone to the University of Toronto's Citizen Lab, which investigated the device.

Citizen Lab, known for spearheading research into international spyware such as Pegasus and Predator, found that the phone had been hacked with Predator spyware in September 2021 for at least two months.

However, the organisation said that the device could have also been infected at a different time, as well as longer than two months.

Seaford booked an appointment for a COVID-19 booster shot in September 2021 using the Greek government’s vaccination portal. The Facebook employee then received an SMS confirming the appointment, and then another SMS message asking her to confirm her details by clicking on a link.

The second text message with the link was reportedly the method used to install the Predator spyware onto her phone.

The vaccination appointment details in the message were correct, and there is a suggestion that someone reviewed the earlier message before manually composing the second, infected message using that correct information.

“Anyone, anywhere can fall prey to spyware hacking. I should know - I was a Predator target,” Seaford said on Twitter. “This does not make it normal. We need our governments and international bodies to protect us.”

This hack would make Seaford the first known case of a US citizen being targeted by spyware in an EU country.

“This Predator case is further evidence that the mercenary spyware problem in the EU is out of control,” said John Scott-Railton, senior researcher at Citizen Lab, on Twitter. “And it's directly impacting US nationals working on sensitive topics.”

Seaford has filed a lawsuit in Greece, which forces prosecutors to open an investigation into the incident. She also filed a request with the independent constitutional watchdog to determine if the national intelligence service wiretapped her phone.

Two NYT sources stated that Seaford had been wiretapped since August 2021 by the intelligence service, and for several months in 2022.

The Citizen Lab investigation found that the information taken from the wiretap might have helped to provide intelligence to organise the attack to implant the spyware.

What is Predator spyware and who makes it?

Predator spyware is a surreptitious program that’s able to offer surveillance capabilities. It's installed on devices through links sent via messages that when clicked, lead to the download of the spyware.

It’s similar to the NSO Group’s Pegasus which was used in the past to target Saudi critic Jamal Khashoggi.

Predator is built and sold by Cytrox, a company founded in North Macedonia with a corporate presence in Israel and Hungary, according to a report from Citizen Lab.

The organisation found that customers for the spyware are likely to be based in Armenia, Egypt, Greece, Indonesia, Madagascar, Oman, Saudi Arabia, and Serbia.

Cytrox has been reported to be part of Intellexa, a 'star alliance of spyware', which aims to compete with the NSO Group, said Citizen Lab. This is a group of surveillance vendors that appeared in 2019, consisting of companies like Nexa Technologies, Cytrox, and Senpai.

Citizen Lab’s report stated that Intellexa operates from Greece, with the alliance having a corporate presence there as well as in Ireland.

In December 2021, the spyware was reported to have targeted the iPhones belonging to two exiled Egyptians, a politician and a journalist. Both individuals received links through WhatsApp which were believed to be used to launch the spyware's installation.

At the time, Citizen Lab said it had medium-to-high confidence that the spyware attacks were carried out by the Egyptian government.

How is Greece connected to wiretapping?

In January 2023, the Greek parliament’s chamber of deputies voted 156 to 143 to defeat a no-confidence vote in Kyriakos Mitsotakis, the Greek prime minister, according to the Guardian.

The vote had been called due to an alleged phone-tapping scandal which saw politicians, military officials, and journalists targeted.

This includes Nikos Androulakis, the head of Greece’s third-largest political party, who claimed that he had been wiretapped by the national intelligence service, as well as being targeted by Predator spyware.

Google has tied a previously unknown spyware operation to a private company in Spain after receiving an anonymous tip-off regarding the malicious activity.

Its Threat Analysis Group (TAG) said the evidence suggests that Barcelona-based Variston IT has developed an exploit framework which leveraged zero days in Windows Defender, Firefox, and Chrome.

Google said the operation tied to Variston IT had developed the Heliconia framework which itself was split into smaller frameworks that exploited different systems and applications, like Windows and Chrome. The product gives customers all the tools needed to deploy a payload to a target device.

The frameworks included mature source code that could deploy the exploits. The first was Heliconia Noise, a web framework used to deploy an exploit for a Chrome renderer bug, followed by a sandbox escape.

Heliconia Soft was a separate web framework that dropped a malicious PDF to exploit a vulnerability in Windows Defender. The third and final framework was called Files - it consisted of a set of exploits targeting Firefox versions on both Windows and Linux systems.

The three companies targeted in the exploit, Microsoft, Mozilla, and Google, fixed the vulnerabilities in 2021 and early 2022. Google said it hadn’t detected active exploitation of the now-patched vulnerabilities, but instead predicted that they were used as zero-days in earlier attacks.

The tech giant only became aware of the Heliconia framework when it received an anonymous submission to its Chrome bug reporting programme.

“The submitter filed three bugs, each with instructions and an archive that contained source code,” said Google TAG researchers in a blog post. “They used unique names in the bug reports including, ‘Heliconia Noise,’ ‘Heliconia Soft’, and ‘Files'.

"TAG analysed the submissions and found they contained frameworks for deploying exploits in the wild and a script in the source code included clues pointing to the possible developer of the exploitation frameworks, Variston IT.”

Heliconia Noise, for example, leaked the name of the company in a line of code that prevented the framework from generating binaries containing strings such as 'Variston'.

The same for loop in Heliconia Noise's code also leaked the aliases of the developers who worked on the project: majinbuu, janemba, and freezer - all references to characters in the Dragon Ball manga franchise.

Google said that commercial spyware is used by governments to spy on journalists, human rights activists, and political opposition through its advanced surveillance abilities. The tech giant is aiming to disrupt the threat of these types of companies to protect users and raise awareness of the industry, it said.

IT Pro has contacted Variston for comment. It appears to be registered at an address in Barcelona and was founded by Jayaraman Ramanan and Ralf Dieter Wegener in 2018, according to Datos Cif, a Spanish database containing information about companies. Deloitte is also named as its auditor.

A malicious browser extension linked to North Korea has been operating undetected to steal data from Gmail and AOL sessions.

The extension, dubbed ‘SHARPEXT’ by researchers, monitors webpages to automatically parse any and all emails and attachments from victims' mailboxes.

It poses a particularly serious threat to machines used by organisations for business operations, as all sensitive information sent via email has the potential to be stolen. Targets have so far been identified within the US, EU and South Korea.

Cyber security firm Volexity revealed the spyware's existence in a blog post, and linked it to a threat actor tracked by Volexity operating under the name SharpTongue, but known publicly as Kimsuky. This entity is believed to be North Korean in origin, and the researchers have linked SharpTongue to attacks on targets linked to national security.

ArsTechnica reports Volexity president Steven Adair as stating that SHARPEXT is installed through “spear phishing and social engineering where the victim is fooled into opening a malicious document”. Phishing is a common vector used to deliver malicious programmes, such as LockBit 2.0 which has been distributed by email disguised as PDFs.

To lay the groundwork for the extension, the threat actor manually exfiltrates files such as the user’s preferences and secure preferences. These are changed to include exceptions for the malicious extension and then downloaded back onto the infected machine through the malware’s command and control (C2) infrastructure.

Once the original files have been switched for these copies, SHARPEXT is loaded directly from the victim’s appdata folder. Once active, the extension executes code directly from the C2 server, which has the benefit of preventing antivirus software from discovering malicious code within the extension itself.

Additionally, running code in this way allows the threat actor to regularly update the code without having to reinstall newer versions of the extension onto infected systems. Indeed, the extension is currently in its third iteration, with previous versions more limited in their browser and mail client compatibility.

At present, SHARPEXT supports Google Chrome and Microsoft Edge, as well as a browser called Whale that's reasonably popular in South Korea but not in other countries.

The extension only activates when a Chromium browser is running, and utilises listeners to monitor activity to ensure that only email data is stolen. Global variables track the emails, email addresses and attachments that have already been exfiltrated, so as to prevent unnecessary duplication of data.

In addition to its exfiltration functions, the extension deploys a Powershell script that constantly checks for compatible browser processes, and if found runs a keystroke script that opens the DevTools panel.

Simultaneously, another script works to hide the DevTools window, and anything that could make the victim suspicious, such as Edge’s warning that an extension is running in developer mode.

Volexity has advised security teams within organisations to review extensions regularly, especially those installed on machines connected to highly-sensitive information.

IT Pro has approached Volexity for comment

The Australian police have arrested a 24-year-old hacker after a lengthy investigation tied him to the widely abused Imminent Monitor remote access trojan (RAT).

The spyware tool was downloaded by more than 14,500 people across 128 countries, the police said, and reportedly generated around $400,000 AUD for the cyber-criminal.

The Australian Federal Police (AFP) also said Imminent Monitor was allegedly first created by Jacob Wayne John Keen nine years ago when he was aged 15.

During its time on sale between 2013 and 2019, it has been used by numerous individuals including domestic and child abusers, among other criminals.

The spyware’s capabilities allowed customers to steal information from victims and spy on them in various ways, including surreptitious enabling and monitoring of the webcam and microphone, logging keystrokes, and remotely controlling the device too.

Imminent Monitor could be installed through various means, including phishing, the AFP said, and it believes there have been more than 10,000 victims worldwide.

“These types of malware are so nefarious because it can provide an offender virtual access to a victim’s bedroom or home without their knowledge,’’ said Chris Goldsmid, AFP commander of cyber crime operations.

“Unfortunately there are criminals who not only use these tools to steal personal information for financial gain but also for very intrusive and despicable crimes.”

The RAT was sold for around $25 USD for a single-user lifetime licence but additional options were available for teams of users sold at higher prices.

The creation and sale of Imminent Monitor prompted a global investigation from law enforcement after the AFP was handed information about the campaign from the FBI and security company Palo Alto Networks in 2017.

More than a dozen law enforcement agencies were involved in the investigation across Europe, issuing a total of 85 search warrants, seizing 434 devices and arresting 13 individuals for using the RAT.

Simply owning the RAT is not an offence, the AFP said, but installing it on another individual’s device is a violation of computer legislation.

AFP dedicated five officers to gathering information on, and ultimately shutting down the RAT. After Imminent Monitor was taken down in 2019, all copies across the globe ceased to work also.

In the same year, the accused individual’s home was searched by authorities and his computer was found with code files consistent with the development and use of the RAT.

The 24-year-old faces 6 criminal charges under computer misuse and data misuse legislation, including two counts of dealing with the proceeds of crime with a value exceeding $100,000.

He faces a maximum potential combined prison sentence of 20 years. A 42-year-old woman of the same address later revealed to be Keen’s mother, also faces one count of dealing with the proceeds of crime with a value exceeding $100,000 and also faces up to 20 years in prison, the AFP notice read.

Microsoft has investigated a ‘suspicious’ Austrian private-sector company, concluding that it is operating illegal offensive security services on behalf of clients in a similar fashion to NSO Group and its Pegasus spyware.

Vienna-based DSR Decision Supporting Information Research Forensic (DSIRF) presents itself as a professional services company with clients across high-value industries, but investigations have revealed it is offering spyware and malware services to clients.

So far, victims include businesses in the UK, Austria, and Panama, and span industries such as banking, law firms, and strategic consultancies, Microsoft said, having spoken to a number of them as part of its research.

The company has been observed chaining together zero-day exploits in Windows and Adobe products to deploy its Subzero malware - a rootkit capable of spying on targeted individuals.

Microsoft has concluded that the company is operating an unauthorised, mercenary offensive security operation similar to that of NSO Group, and has given the threat actor the codename Knotweed.

The group is secretive in its operations and only reveals the full extent of its capabilities to clients in exclusive meetings.

There is no evidence that it operates a genuine professional services operation as it claims to and it is also believed to have ties to the Russian regime.

Unmasking Knotweed - Russian links to illegal EU surveillance

DSIRF’s website says it is primarily based in Austria but also has an office in Lichtenstein. Its ‘about’ section is written in non-descript verbiage that alludes to offering services across information research, forensics, and data-driven intelligence.

It also claims to have multinational clients on its books across the technology, retail, energy, and financial sectors.

Reports linking DSIRF to malicious cyber activity date back to 2021 when several investigations that were conducted by German-speaking media linked the company to the sale of offensive security services.

First reported by Focus, a DSIRF presentation given exclusively to clients was leaked to the publication and revealed the full suite of services the company offered.

The presentation - made public by Netzpolitik - reportedly mentioned cyber warfare, biometric facial recognition, and the unmasking of foreign information warfare tactics.

The clients were eventually introduced to its Subzero malware product which the company claimed, in a six-minute video presentation, to be able to link up with surveillance cameras installed at the likes of train stations and airports.

Its program could supposedly connect to a DSIRF-controlled database and process footage against biometric, social network, criminal record, and payment data to deliver conclusions to the controller in real time.

According to the investigation conducted by Focus, the Austrian Ministry of Finance confirmed the company to be owned by Peter Dietenberger, a German national with residency in Austria and Switzerland.

Dietenberger is also believed to be a ’specialist’ in relations between the West and Russia with connections to the Russian nomenklatura, while also his visa identified him as a special guest of the presidential administration.

The leaked presentation itself was reportedly addressed to Jan Marsalek, a former board member and COO at the infamous German payment processor Wirecard. The internationally-wanted white-collar criminal is now believed to be a fugitive in Moscow under the protection of the FSB following his alleged involvement in the Wirecard scandal.

Subzero in focus

Microsoft’s investigation focused more on the malware offered by the company named Subzero. It said it could be deployed in several different ways but in all cases, it used a remote code execution (RCE) vulnerability in Adobe Reader, coupled with a now-patched privilege escalation exploit in Windows (CVE-2022-22047).

The malware seen by Microsoft was packaged in a PDF document sent to a victim via email but was not able to gain visibility into the entire exploit chain, it said.

The victim's version of Adobe Reader was released in January 2022 which suggests that the exploit was developed between January and May 2022, despite the company’s C2 infrastructure indication that it had been active since 2020.

“The exploit chain starts with writing a malicious DLL to disk from the sandboxed Adobe Reader renderer process,” Microsoft said. “The CVE-2022-22047 exploit was then used to target a system process by providing an application manifest with an undocumented attribute that specified the path of the malicious DLL.

“Then, when the system process next spawned, the attribute in the malicious activation context was used, the malicious DLL was loaded from the given path, and system-level code execution was achieved.”

It revealed that other security vulnerabilities were used to deploy Subzero in victims dating back to 2021, indicating that deployment tactics changed over time and there were active efforts from DSIRF to find new ways of exploiting victims.

Other tactics involved delivering Subzero via malicious Microsoft Excel documents using Excel 4.0 VBA macros - which are now once again blocked by default after a temporary backtrack - and obfuscated using large chunks of text taken from the Kama Sutra.

Main capabilities

Corelump is the main malicious payload delivered by the Subzero program. It resides in memory to escape detection and offers a range of functions including keylogging, capturing screenshots, exfiltrating files, running a remote shell, and running arbitrary plugins downloaded from Knotweed’s C2 server, Microsoft said.

Post exploitation activities observed by Microsoft included credential dumping, accessing emails using dumped credentials, and running PowerShell scripts from a DSIRF-linked GitHub gist.

How to defend against Knotweed and Subzero

Microsoft has advised businesses to patch against the latest security threats, including the recently patched CVE-2022-22047 to prevent exposure to the exploit chain.

Ensuring antivirus products are up-to-date is also recommended, as is scanning for the confirmed indicators of compromise (IOCs) that can be found in Microsoft’s full report.

It’s advised that Excel macro settings are reviewed to make sure malicious VBA and XLM macros are blocked by turning on runtime macros scanning by antimalware scan interface (AMSI), which should be enabled by default.

Enabling multifactor authentication (MFA) can help mitigate any compromised credentials being used by the threat actor and reviewing all authentication activity for remote access infrastructure, and scanning for anomalous activity, is also advised.

MacOS users have been warned that a new spyware has been discovered using a previously undocumented backdoor to steal sensitive data from compromised Macs.

Lifting sensitive data such as keystrokes, screen captures, and email attachments, the spyware uses public cloud storage such as Yandex Disk, pCloud, and Dropbox as its command and control (C2) channel. Although such use of cloud storage has been observed in Windows malware, researchers noted that this is an unusual tactic in the Mac ecosystem.

The malware, coded in Objective-C, was discovered by ESET researchers who named it 'CloudMensis' in a blog post. The method by which the malware first compromises the Macs of its victims is still unknown.

Lack of clarity around this delivery mechanism, as well as the identity and goals of the threat actors, has prompted researchers to warn all MacOS users to be cautious and keep systems up-to-date. However, as it has currently been seen to affect only a limited number of systems, CloudMensis has not currently been labelled high risk.

Once present on a victim’s Mac, the first stage of CloudMensis downloads a second stage from public cloud storage, and both are written to disk. Once installed, CloudMensis receives commands from its operators through this cloud storage, and sends encrypted copies of files through it.

A total of 39 commands can be activated allowing the malware to, among other things, change its configuration values, run shell commands, and list files from removable storage.

To bypass macOS’ privacy protection system Transparency, Consent and Control (TCC), CloudMensis adds entries to grant itself permissions. If the victim is running a version of macOS predating Catalina 10.15.6, CloudMensis will exploit a known vulnerability (CVE-2020-9943) to load a TCC database that it can write to.

Metadata uncovered by ESET indicated that the threat actors behind the spyware are individually deploying CloudMensis to targets of interest, rather than spreading it as far as they can.

No clues to the intended targets have been found in the metadata, and the use of cloud storage as its C2 makes the threat actors behind it difficult to identify. ESET accessed metadata from the cloud storage services in use that indicates that the unknown threat actors began to send commands on February 4, 2022.

“We still do not know how CloudMensis is initially distributed and who the targets are,” said ESET researcher Marc-Etienne Léveillé, a member of the team that is looking into CloudMensis.

“The general quality of the code and lack of obfuscation shows the authors may not be very familiar with Mac development and are not so advanced. Nonetheless, a lot of resources were put into making CloudMensis a powerful spying tool and a menace to potential targets.”

No zero-day vulnerabilities have been identified as in use by the group, so Macs that are regularly updated are potentially at lower risk.

MacOS malware is typically rarer than Windows malware, for a multitude of reasons including the fact that the larger market share of Windows PCs gives cybercriminals a better target.

Apple has acknowledged the threat of spyware such as Pegasus, and is set to introduce a new ‘Lockdown Mode’ on iOS, iPad OS and macOS in the autumn.

Apple has teased an upcoming security initiative for iPhone, iPad, and Mac users who believe they may be targeted of state-sponsored spyware campaigns in the mould of Pegasus, Predator, and Hermit.

Lockdown Mode, which is coming to iOS 16, iPad OS 16 and macOS Ventura in autumn, will implement stricter security measures on Apple devices to combat the exfiltration or monitoring of sensitive data flowing in and out of Apple hardware.

The feature will offer “extreme, optional protection for the very small number of users who face grave, targeted threats to their digital security”.

Embattled Israeli outfit NSO Group’s Pegasus spyware is perhaps the most infamous programme of this kind, having been found on the devices of numerous high-profile individuals over the past several years, including murdered Saudi journalist Jamal Khashoggi.

Despite being discovered years ago, and with Apple releasing security patches to prevent it infecting devices, Pegasus continues to infect individuals’ devices today.

Reports from this year have indicated government officials in both the UK and El Salvador have been targeted, years after the first known Pegasus case was reported.

“While the vast majority of users will never be the victims of highly targeted cyberattacks, Apple will work tirelessly to protect the small number of users who are,” said Ivan Krstić, head of security engineering and architecture at Apple on Twitter. “I’m deeply proud of our next steps, including a groundbreaking feature: Lockdown Mode.”

Technical implementations

Apple calls Lockdown Mode a ‘first of its kind feature’ that'll offer a swathe of technical features to keep the digital lives of targeted individuals safe from state-sponsored spyware.

For messaging, Lockdown Mode will block most major attachment types, other than images, and block other features like link previews.

While Apple didn’t explicitly state the reason for this, the measure could have been implemented in relation to Pegasus previously being installed by exploiting a no-click vulnerability in Apple’s iMessage.

A number of “complex web technologies” involved in on-device web browsing will also be blocked, Apple said. Things like just-in-time (JIT) JavaScript compilation - a method of compiling code to make both execution and the overall experience faster - will be disabled unless a user whitelists a given website in Lockdown Mode’s settings, for example.

Incoming invitations and service requests such as FaceTime calls will be blocked for users who have never interacted with the initiator before, and wired connections to other computers or accessories will also be blocked when an iPhone is locked, Apple said.

Lastly, configuration profiles will not be able to be installed, nor can devices be enrolled into mobile device management (MDM) programmes - combatting a method of spyware installation exploited by Hermit. However, Krstić confirmed pre-existing MDM enrollment is preserved after enabling Lockdown Mode.

Apple said it will continue to add additional features to Lockdown Mode over time and as user feedback is received.

It has also added a special category to its pre-existing bug bounty programme for Lockdown Mode bypasses, offering what it calls the largest potential payout for any bug bounty in the industry – $2 million (£1.67 million) – as a reward for the most severe submissions.

$10 million fund

In addition to the launch of Lockdown Mode, Apple said it will be setting up a $10 million grant, plus any additional funds generated from the damages it receives in its ongoing lawsuit against Pegasus creators NSO Group, to support organisations fighting highly targeted cyber attacks.

Such organisations could include those making efforts to quell state-sponsored spyware attacks, or those tasked with investigating and exposing the operators behind them - and other types of targeted attacks on digital security.

The grant will be made available to the Dignity and Justice Fund which expects to issue the first round of grants in late 2022 or early 2023.

“There is now undeniable evidence from the research of the Citizen Lab and other organisations that the mercenary surveillance industry is facilitating the spread of authoritarian practices and massive human rights abuses worldwide,” said Ron Deibert, director at Citizen Lab, a research group at the University of Toronto long-famed for its investigations into state-sponsored spyware.

“I applaud Apple for establishing this important grant, which will send a strong message and help nurture independent researchers and advocacy organisations holding mercenary spyware vendors accountable for the harms they are inflicting on innocent people.”

Multiple cases of the covert Pegasus spyware have been found targeting journalists and activists in El Salvador, a report from Citizen Lab at the University of Toronto has revealed.

A total of 35 cases were confirmed after journalists and members of civil society contacted Citizen Lab to analyse their devices after becoming suspicious of a Pegasus infection, which allows operators to surreptitiously install information-harvesting and remote monitoring tools on targeted iPhones.

Targets included journalists at Salvadoran news outlets El Faro, GatoEncerrado, La Prensa Gráfica, Revista Digital Disruptiva, Diario El Mundo, El Diario de Hoy, and two independent journalists.

Fundación DTJ - an NGO promoting transparency in the Salvadoran justice system, Cristosal - a school on human rights, and another unnamed NGO were also successfully targeted by Pegasus, Citizen Lab said.

Developed by Israeli outfit NSO Group, Pegasus has been used to target a number of high-profile journalists, activists, and diplomatic figures in recent years, including prominent journalist and Saudi critic Jamal Khashoggi who was murdered in 2018.

Many of the affected individuals received notifications from Apple on their devices indicating they may have been a victim of a state-sponsored spyware campaign. Apple launched a lawsuit against NSO Group the same day.

The confirmed cases were corroborated by Amnesty International’s Security Lab, an independent analysis group that drew the same conclusions as Citizen Lab.

Uncovering Pegasus

The researchers said attribution is typically difficult in Pegasus cases due to the way the spyware hides key data, but in this case, the analysis revealed one operator operating almost exclusively on El Salvador soil since at least November 2019.

Citizen Lab researchers refer to this individual as TOROGOZ and have connected the operator to an infection attempt against the El Faro news organisation.

"While there is no conclusive technical evidence that TOROGOZ represents the Salvadoran government, the strong country-specific focus of the infections suggests that this is very likely," the Citizen Lab report said. "Additionally, in the single case of hacking in this investigation in which we recovered the domain names of the Pegasus servers used, the TOROGOZ operator was implicated."

The researchers were unable to attribute the attacks to NSO Group or the El Salvador administration, but found evidence that strongly suggested the operator had ties with the country's government.

The timing of the attacks coincided with moments at which the affected organisations were working on issues with great interest to President Nayib Bukele - perhaps best known in the technology community as the brainchild of El Salvador's volcano-powered Bitcoin city and the decision-maker in adopting Bitcoin as an official national currency in 2021.

TOROGOZ's "near-total focus of infections within El Salvador" was another clue linking the cases to the government, Citizen Lab said, as well as one individual from El Faro being targeted with Pegasus' telltale zero-click FORCEDENTRY exploit which is patched on more recent iOS versions.

NSO Group has consistently denied any wrongdoing and claims Pegasus is a national security tool that is not used for malicious purposes, including state-sponsored espionage. A 2021 investigation found at least ten countries had access to Pegasus and El Salvador was not previously included in that list.

Technical analysis of the attacks

Two zero-click exploit chains were used against the targeted journalists: KISMET and FORCEDENTRY. The latter of these two exploits affects older versions of iOS but was sent to an El Faro journalist's patched iPhone. Citizen Lab said it's unclear why a patched device was targeted with FORCEDENTRY but it may indicate that operators may not always be able to determine the device's iOS version before launching an attack.

KISMET is another exploit chain that requires no user interaction with a device in order to achieve infection. First disclosed in 2020, it too is now patched in more recent versions of iOS but was used in attacks launched between July and December 2020, on devices running iOS versions 13.5.1 to 13.7.

Researchers are only able to extract a forensic artefact from the KISMET exploit chain, rather than the full exploit, but it is thought to utilise .JPG attachments and an old iMessage flaw.

There are also variants of Pegasus available for Android smartphones too, which is "capable of extracting data from popular messengers such as WhatsApp, Facebook, and Viber, as well as email clients and browsers," said Jakub Vavra, Mobile Threat Analyst at Avast, speaking to IT Pro.

"The spyware is capable of remote surveillance through microphone and camera as well as taking screenshots of the user’s screen and keylogging the user's inputs. These features make it a dangerous tool that can be misused to spy on unwitting individuals."

El Salvador media and political landscape

El Salvador has a troubled history tainted with cases of authoritarianism and coups - in addition to organised crime, drug trafficking, and corruption. Civil war ravaged the country in the late 1900s which left a legacy of political and military corruption.

There are plenty of critical news organisations in the region, but journalists face challenges in the form of press freedoms and access to information. The country is often ranked poorly in terms of the level of freedom given to the press - it ranks 82nd for press freedom according to Reporters Without Borders - and there are a number of cases where journalists have been blocked from attending events such as government conferences.

A new strain of spyware targeting high-profile exiled politicians and journalists has been discovered by the same organisation that investigated and alerted the world to NSO Group's Pegasus tool.

Two Egyptian exiles, a politician and a journalist, were found to have had their Apple iPhones infected with Predator spyware in June 2021, following an inspection by Citizen Lab.

Predator is regarded as being a program with similar capabilities to NSO Group's Pegasus, which was used to target figures such as journalist and Saudi critic Jamal Khashoggi.

Predator is built and sold by North Macedonian startup Cytrox, which Citizen Lab researchers believe has a number of government clients across Africa, Eastern Europe, and the Middle East. It's also thought to have private customers in Armenia, Egypt, Greece, Indonesia, Madagascar, Oman, Saudi Arabia, and Serbia.

The Predator spyware offers similar surveillance capabilities to Pegasus but is less technical in its exploitation approach. Instead of utilising an undisclosed zero-day vulnerability in iOS, it instead operates using a phishing-like attack framework using links sent via WhatsApp messages that lead to one-click infections.

An iPhone belonging to Ayman Nour, former Egyptian presidential candidate and president of the Egyptian political opposition group Union of the Egyptian National Forces, was found in June 2021 to be infected with both Predator and Pegasus spyware at the same time, with the hacks conducted by two separate government clients.

Citizen Lab believes with medium-to-high confidence the Predator attacks on both Egyptian exiles were ordered by the Egyptian government as a Cytrox customer.

Nour's iPhone is said to have been repeatedly attacked with Pegasus Spyware since March 2021 using the NSO Group's iOS zero-day FORCEDEXPLOIT. Phone logs also showed a number of processes related to Predator spyware running on the device, with researchers concluding that clicking on links sent to Nour via WhatsApp from an Egyptian number purporting to be a Dr Rania Shhab led to the phone being infected with Predator.

Nour was first alerted to the possibility of a hack when he noticed his phone running unusually hot - an indicator which later revealed two separate surveillance tools running at the same time.

The second target, an exiled Egyptian journalist who wished to remain anonymous, received similar texts from a number purporting to be an assistant editor at the Al Masry Al Youm newspaper.

Citizen Lab was only able to obtain samples of Predator's loader, not the entire exploit, which it believes remains active in the wild. The organisation's analysis showed Predator persists on iOS even after rebooting, using Apple's automation feature.

From its initial inspection in June 2021, Citizen Lab said the spyware was able to infect the then-latest iOS version (version 14.6) but it's unclear if the current version of Apple's mobile operating system is vulnerable too. IT Pro contacted Apple for clarity but it did not reply in time for publication, though it told Citizen Lab it was investigating the issue.

Cytrox is believed to be part of Intellexa, a collective of spyware groups formed to compete with the now-financially struggling NSO Group. Intellexa describes itself as EU-based and regulated with six sites and R&D labs throughout Europe, Citizen Lab said.

Knowledge of the 'spyware alliance' is "murky at best", Citizen Lab said, but it's thought the group was formed in 2019 and now operates out of Greece after first basing itself in Cyprus.

Meta released a report following Citizen Lab's findings announcing it was taking action against surveillance-for-hire groups. Cytrox, along with others unrelated to Intellexa, were specifically named in the report. Meta already banned and sued NSO Group in 2019 for its surveillance programme.

Pages belonging to a total of seven companies known for surveilling others using a mercenary business model have been banned by Meta, and it has also alerted around 50,000 individuals it believes may have been targeted by the companies.

A number of US officials have been reportedly been contacted by Apple informing them that their iPhones have been hacked by NSO Group.

Early efforts have led investigators to believe that the hack was carried out using the Pegasus tool developed by Israel-based NSO Group. The company was only recently added to the US’ entity list.

The attacks targeted US State Department staff either working in Uganda or focusing their work on matters related to the African country, according to Reuters which first reported the story.

The attacks are believed to have taken place over the past few months and initial reporting revealed at least nine staff were successfully targeted, with other reports suggesting the number might be slightly higher at 11.

NSO Group published a statement on Friday saying it plans to investigate the situation and terminate the contract it has with whatever country is found to have misused the Pegasus tool.

“Last night, following an inquiry we received alleging Ugandan phone numbers used by US government officials were hacked, we immediately shut down all the customers potentially relevant to this case, due to the severity of the allegations, and even before we began the investigation,” said NSO Group.

“This termination took place despite the fact that there is no indication the phones were targeted by NSO’s technology. The claims of all involved parties specifically mentioned there is no indication, let alone proof, that it was NSO’s tools that were used by these customers.”

IT Pro contacted the US State Department and Apple for comment but neither replied at the time of the publication. Both have declined to comment to other media.

NSO Group has faced numerous challenges in the previous few months. Most recently, Apple filed a lawsuit against the company for allegedly hacking Apple users and violating US laws.

Since the group was linked to Pegasus, the highly invasive spying tool made by NSO Group and licensed to other countries with approval from the Israeli government, many western countries have turned their backs on the company.

The US government added NSO Group to its entity list which heavily restricts the business opportunities of those on the list with the US.

It was this development that led newly appointed CEO Isaac Benbenisti to quit the post before he even started at the company.

As well as reportedly being faced with significant financial difficulty, NSO Group has continually battled the allegations fielded to it, that it helps rogue nations attack activists, journalists, and other individuals deemed to be threats.

Notable victims of the Pegasus spyware include Jamal Khashoggi, a prominent critic of the Saudi Arabian government, whose phone was found to have Pegasus installed on it after he was murdered in Istanbul in 2018.

NSO Group remains firm on its stance that Pegasus is not a tool to be used for malicious purposes and instead Pegasus is bought and used by governments for good, like combatting terrorism.

The company has said it installed security controls in Pegasus which prevent spying on innocent targets. For example, Pegasus cannot be used on US phone numbers, those beginning with a +1 country code.

The US officials found to have Pegasus on their iPhones were using Ugandan-registered phones, reports indicate, which means the country code would have been different and perhaps not included in the security controls for innocents.

New spyware has been discovered by security researchers that snoops on North Korean defectors and journalists that cover news on the Korean peninsula.

Dubbed Chinotto, the spyware is linked to a gang of hackers called ScarCruft, a group is linked to the North Korean government. The hackers are also known as APT37 or Temp.Reaper.

"The actor utilized three types of malware with similar functionalities: versions implemented in PowerShell, Windows executables, and Android applications," said researchers at Kaspersky.

"Although intended for different platforms, they share a similar command and control scheme based on HTTP communication. Therefore, the malware operators can control the whole malware family through one set of command-and-control scripts."

According to a blog post by Kaspersky, hackers contact an acquaintance of the victim using the victim’s stolen Facebook account and already knew that the potential target ran a business related to North Korea and asked about its current status.

Following conversations on Facebook, a spear-phishing email is sent to the potential victim using a stolen email account. This email contains a password protected RAR archive with the password shown in the email body. The RAR file contains a malicious Word document that acts as a lure related to North Korea.

This word document when opened executes a macro and decrypts another payload embedded in the document. This Visual Basic Application (VBA) payload contains shellcode as a hex string. This script is responsible for injecting the shellcode into the process notepad.exe. The shellcode contains the URL to fetch the next stage payload. After fetching the payload, the shellcode decrypts it with trivial single-byte XOR decryption.

Researchers couldn’t gather the final payload when they investigated this sample. However, they did work out that one of the malware’s victims was breached on March 22, 2021, based on a file timestamp.

The Chinotto malware collected screenshots and exfiltrated them between August 6, 2021, and September 8, 2021.

In addition to a Windows version, Chinotto also has an Android version that carries out similar tasks. Researchers said the Android malware requests excessive permissions according to the AndroidManifest.xml file

“To achieve its purpose of spying on the user, these apps ask users to enable various sorts of permissions. Granting these permissions allows the apps to collect sensitive information, including contacts, messages, call logs, device information, and audio recordings,” said researchers.

"Many journalists, defectors, and human rights activists are targets of sophisticated cyberattacks," they added. "Unlike corporations, these targets typically don't have sufficient tools to protect against and respond to highly skilled surveillance attacks."

Apple has filed a lawsuit against Israel-based NSO Group for allegedly hacking Apple users and violating US federal and state laws.

In addition to the lawsuit against NSO Group and its parent company OSY Technologies, Apple will also seek a permanent injunction to ban NSO Group from using any product made by Apple, including software, hardware, and services.

Apple said NSO Group has created "sophisticated, state-sponsored surveillance technology" to allow whoever purchases a licence to use it to surveil a highly targeted, small selection of individuals.

NSO Group is most famous for creating the Pegasus spyware capable of monitoring and stealing information from specific targets' devices and allegedly selling it to nation-states.

"State-sponsored actors like the NSO Group spend millions of dollars on sophisticated surveillance technologies without effective accountability. That needs to change,” said Craig Federighi, senior vice president of software engineering at Apple.

“Apple devices are the most secure consumer hardware on the market — but private companies developing state-sponsored spyware have become even more dangerous," he added. "While these cybersecurity threats only impact a very small number of our customers, we take any attack on our users very seriously, and we’re constantly working to strengthen the security and privacy protections in iOS to keep all our users safe.”

Apple plans to reveal new information about the FORCEDENTRY exploit Pegasus used to gain access to the microphone, camera, and sensitive data on iOS and Android devices as part of the lawsuit.

NSO Group's hacking history

The exploit was first discovered by Citizen Lab researchers based at the University of Toronto. Apple patched this no-click zero-day vulnerability in September this year which saw bad actors able to send malicious iMessages and infect a victim's iPhone, iPad, Apple Watch, and Mac without any user intervention.

"Part of [NSO Group's] pitch is you don’t need much sophistication; just sit at this console, enter a phone number, and presto, you can start pulling data from that phone," said John Scott-Railton, senior researcher at Citizen Lab to the Darknet Diaries podcast. "Their business model is kind of somewhere between hacking as a service and the provision of software.

"Basically what they’re offering to their customers is the ability to target an arbitrary cell phone and gain access and persistence," he added.

Earlier this year, a joint investigation by 17 global media organisations revealed that Pegasus spyware was sold to authoritarian governments and then targeted at least 50,000 journalists, government officials, human rights activists, and other high-profile figures.

In perhaps the most high-profile Pegasus case to date, forensic investigations following the high-profile killing of journalist Jamal Khashoggi in 2018, ordered by the Saudi Arabian government - an NSO Group client, revealed Pegasus spyware was found on his mobile phone.

Asked directly about whether it knows that Pegasus was being used to surveil journalists and violate human rights, Shalev Hulio, co-founder of and the 'S' in NSO Group, said to Darknet Diaries: "I only say that we are selling Pegasus in order to prevent crime and terror".

That's the typical line given to media from NSO Group which believes Pegasus has saved the lives of tens of thousands of people.

US sanctions and financial instability

The US imposed sanctions on NSO Group in November 2021, along with three other companies, stipulating that no US companies may have any dealings with NSO Group without a license from the US government.

The move prompted NSO Group's CEO Isaac Benbenisti to quit the role he accepted less than a week prior. Benbenisti hadn't even started his job at NSO Group before his resignation was announced a week after US sanctions were announced.

The sanctions had additional ripple effects on the company as Bloomberg reported that Wall Street is now treating it as a distressed asset, which could lead to further revenue contraction, and that it is currently struggling to repay a $500 million (£374 million) debt.

NSO Group is reportedly facing cash flow issues and recent alleged attempts to generate further sales with nations such as France - an allegation France denies - have failed.

The newly-appointed CEO of Pegasus spyware-maker NSO Group has handed in his resignation only two weeks after taking the helm.

Isaac ‘Itzik’ Benbenisti, who was named CEO of the Israel-based company on 31 October, had not yet started his job when he decided against replacing co-founder and acting CEO Shalev Hulio.

A spokesperson for NSO Group told IT Pro that Hulio "will remain in his position as CEO for the near future, due to the need for stability and continuity during this period".

Benbenisti’s departure is said to have been motivated by the trade ban imposed on NSO Group by the US Commerce Department last week, according to reports from Haaretz.

The sanctions mean that NSO Group can no longer sell its products to US customers and is also barred from accessing US technologies, on grounds of national security.

Sources told the publication that Benbenisti had grown wary of the “ongoing challenges” faced by the company, including potential legal and financial repercussions, since it was outed as a spyware supplier to authoritarian governments.

In July, an investigation conducted by 17 media organisations found that NSO Group’s Pegasus tool was used to target at least 50,000 journalists, government and union officials, human rights activists, business executives, religious figures, academics, NGO employees, and lawyers.

Although at the time the greatest repercussion of the investigation was AWS’ decision to shut down NSO Group’s infrastructure and accounts, the sanctions imposed by the US on 3 November have shown that the company is yet to face the full consequences of trading with authoritarian regimes.

This could also include an investigation by the US State Department, which last week was proposed by four members of Congress.

“We have closely tracked the parallel and reinforcing proliferation of commercially distributed surveillance and cyber-intrusion tools. These are extremely sensitive and powerful technologies used by foreign governments against Americans, as well as against journalists and civic activists," the joint statement on the proposed investigation read.

"While recent reporting confirmed that NSO Group's Pegasus software was used against journalists, human rights activists, and opposition politicians, many others are profiting from this new arms market."

This is the second resignation this year for Benbenisti, who in April stepped down as CEO of mobile network operator Partner Communications after six years in the role.

The US has banned Israeli company NSO Group, which sells the Pegasus spyware, and three other companies.

The prohibition means US companies wishing to import or export products or services related to NSO Group must now obtain a license from the government.

The US ban could represent a severe blow for NSO Group, not only in terms of its ability to sell products to customers in the US but also by restricting its access to US technologies for the development of future ones.

US companies can no longer have any kind of relationship with NSO since "there is a risk of becoming involved in activities that are dangerous to national security," thus leading to heavy government penalties.

The Entity List update also included Candiru, another Israeli company active in developing and selling spyware. NSO Group and Candiru were added to the Entity List based on a determination that they developed and supplied spyware to foreign governments that used this tool to maliciously target government officials, journalists, business people, activists, academics, and embassy workers, according to the State Department.

In a ruling by the US Commerce Department’s Bureau of Industry and Security (BIS), the government said these tools have “enabled foreign governments to conduct transnational repression, which is the practice of authoritarian governments targeting dissidents, journalists and activists outside of their sovereign borders to silence dissent. Such practices threaten the rules-based international order.”

In addition, Positive Technologies and COSEINC were added to the Entity List based on a determination they “misuse and traffic cyber tools that are used to gain unauthorized access to information systems in ways that are contrary to the national security or foreign policy of the United States, threatening the privacy and security of individuals and organizations worldwide.”

“The United States is committed to aggressively using export controls to hold companies accountable that develop, traffic, or use technologies to conduct malicious activities that threaten the cybersecurity of members of civil society, dissidents, government officials, and organizations here and abroad,” said commerce secretary Gina Raimondo.

The announcement comes as part of the Biden-Harris Administration’s efforts to put human rights at the center of US foreign policy, including by working to stem the proliferation of digital tools used for repression.

Hackers are pretending to be human rights organization Amnesty International to target users with a fake anti-spyware product in a new malware campaign.

Victims were duped into downloading malware they thought was protection against NSO Group’s Pegasus spyware, according to security researchers at Cisco Talos.

Amnesty International recently published a report on the widespread use of Pegasus to target international journalists and activists. Hackers capitalized on this by setting up a fake website that looked like Amnesty International's and linked to an antivirus tool to protect against Pegasus. However, the download installs the little-known Sarwent malware.

Cisco Talos researchers Vitor Ventura and Arnaud Zobec said that Salwent, a remote access tool (RAT), opens a backdoor on the victim machine. It can also activate the remote desktop protocol on the victim machine, potentially allowing the adversary to access the desktop directly.

“We believe this campaign has the potential to infect many users given the recent spotlight on the Pegasus spyware. In addition to Amnesty International's report, Apple recently released a security update for iOS that patched a vulnerability attackers were exploiting to install Pegasus. Many users may be searching for protection against this threat at this time,” the researchers said.

Researchers were highly confident the hackers behind the campaign are Russian and have been running Sarwent-based attacks on a variety of victims since January 2021. They also said they were uncertain about the actor’s intentions.

“The use of Amnesty International's name, an organization whose work often puts it at odds with governments around the world, as well as the Pegasus brand, a malware that has been used to target dissidents and journalists on behalf of governments, certainly raises concerns about who exactly is being targeted and why,” said researchers.

Investigations failed to find supporting data to make clear whether this is a financially motivated actor using headlines to gain new access, or a state-supported actor going after targets who are rightfully concerned about the threat Pegasus presents to them.

Researchers concluded that while it may seem like an actor trying to gather some easy-to-monetize information, some aspects, such as the level of customization with the RAT, intentionally misleading information, and the low volume of targets, indicate this may be a more advanced actor without financial motivation.

Apple has issued a fix for a vulnerability in iOS, iPadOS, watchOS and macOS that paved the way for the spyware company NSO Group to develop and market a zero-click exploit to national government clients.

The ForcedEntry exploit, which targets the vulnerability tracked as CVE-2021-30860, centres on Apple’s image rendering library and effectively bypasses the in-built Apple security feature known as BlastDoor.

NSO Group had deployed the zero-click exploit to the Bahraini government, only for the client to target Bahraini activists between February and July 2021, according to Citizen Lab, which discovered the vulnerability.

Hackers had been able to exploit CVE-2021-30860 by sending a malicious iMessage that required no user interaction in order to compromise its victim.

This exploit is really similar in nature to another flaw the NSO Group had weaponised, known as Kismet, which was also used to target Bahraini activists.

Apple, however, has now issued patches for both this flaw and a WebKit vulnerability tracked as CVE-2021-30858 that’s also been exploited in the wild. This latter is a use after free issue that was addressed with improved memory management.

“Despite promising their customers the utmost secrecy and confidentiality, NSO Group’s business model contains the seeds of their ongoing unmasking,” a team of Citizen Lab researchers said.

“Selling technology to governments that will use the technology recklessly in violation of international human rights law ultimately facilitates discovery of the spyware by investigatory watchdog organizations, as we and others have shown on multiple prior occasions, and as was the case again here.”

Kismet was actually never acknowledged as a vulnerability in Apple’s systems, with Citizen Lab suggesting the underlying flaw, if it still exists, was rendered obsolete by the BlastDoor mitigation introduced with iOS 14. This tool sandboxes incoming iMessages to protect users from malicious texts.

It’s likely for this reason that NSO Group developed the ForcedEntry exploit, to circumvent Apple’s additional layer of protection.

The organisation has gained notoriety for its spyware tools, having previously developed the Pegasus spyware that was eventually used to target journalists and activists through a WhatsApp vulnerability.

The government of Bahrain has once again used spyware from Israeli surveillance company NSO to target activists' smartphones, according to a Citizen Lab report,

The spyware employed two exploits targeting Apple's iMessage system, including a new one first spotted in June.

The report tracked the targeting of nine Bahraini activists using the NSO software. The investigation ties the infection servers to NSO's Pegasus spyware, and tracked the spyware's use of multiple vulnerabilities in iMessage.

Citizen Lab researchers noted that a Bahrain government operator codenamed LULU compromised iPhones using Pegasus via a zero-click iMessage exploit known as KISMET between July and September 2020. This simply required the phone to receive a message, enabling the spyware to compromise the operating system and monitor its internet traffic.

KISMET compromised iOS versions until at least version 13.7, according to the Citizen Lab. At that point, Apple updated iOS with the BlastDoor security feature that defended against zero-click iMessage attacks. NSO's Pegasus spyware then resorted to a single-click attack, requiring victims to follow a link in an iMessage.

Pegasus returned to zero-click attacks from February 2021 with a more recent exploit Citizen Lab called FORCEDENTRY.

FORCEDENTRY appears to be the same as Megalodon, an attack Amnesty International identified in June. It is a zero-click attack that could compromise phones without any user interaction. Amnesty confirmed it had compromised iPhones running iOS 14.6 in June, and Apple told the organization it was investigating the issue. At the time of writing, the latest version of iOS is 14.7.

Freedom House, a non-profit that promotes democracy worldwide, classified Bahrain as “Not Free,” and gives it a freedom score of 29% due to heavy restrictions on internet use and strong censorship practices. The country arrests internet users for discussing forbidden topics online and engages in online surveillance practices, including spyware.

Citizen Lab first documented Bahrain Pegasus use in 2018 via a government operator that it called PEARL. It posited that LULU may be the same state surveillance team.

NSO continues to face challenges as it sells spyware to countries with oppressive histories, including Bahrain. Amazon Web Services shut down NSO infrastructure running on its servers last month, and United Nations human rights experts renewed calls for an international moratorium on the sale of spyware.

The Citizen Lab cited tools from other companies the Bahrain government used for online surveillance, including Cellebrite, FinFisher, Netsweeper, Trovicor, and Verint.

Amazon Web Services (AWS) has shut down infrastructure and accounts linked to Israeli firm NSO Group.

The news comes after an investigation found that the company’s Pegasus spyware was used to target at least 50,000 journalists, government and union officials, human rights activists, business executives, religious figures, academics, NGO employees, and lawyers.

Pegasus was used to extract messages, photos, and emails, as well as to record calls and activate microphones on iOS and Android devices.

NSO Group denied the accusations, stating that its tools are used “for the sole purpose of saving lives through preventing crime and terror acts”.

“Our technologies are being used every day to break up pedophilia rings, sex and drug-trafficking rings, locate missing and kidnapped children, locate survivors trapped under collapsed buildings, and protect airspace against disruptive penetration by dangerous drones,” the company announced.

However, AWS has branded NSO Group’s actions as “hacking activity”.

A spokesperson for the cloud computing provider told IT Pro that it had shut down NSO Group’s infrastructure as it “was confirmed to be supporting the reported hacking activity”.

This was “in accordance with [AWS’] terms of use”, they added.

Amnesty International, a partner of the Pegasus Project, a collective of 17 media organisations investigating the spyware, found evidence to suggest that NSO Group had only been an AWS customer for a few months.

One Pegasus-infected phone that was dissected by the organisation sent data "to a service fronted by Amazon CloudFront, suggesting NSO Group has switched to using AWS services in recent months”.

Amazon CloudFront is a content delivery network (CDN) that provides customers with the ability to deliver content, including data, videos, and APIs, securely with low latency and at a high speed.

“Amnesty International suspects the shutting down of the V4 infrastructure coincided with NSO Group’s shift to using cloud services such as Amazon CloudFront to deliver the earlier stages of their attacks,” said the human rights NGO, adding that “the use of cloud services protects NSO Group from some Internet scanning techniques”.

AWS didn’t elaborate on whether the decision to ban NSO Group from its services could be reconsidered in the future.

Spyware manufactured by Israeli firm NSO Group was sold to authoritarian governments to target at least 50,000 journalists, government and union officials, human rights activists, business executives, religious figures, academics, NGO employees, and lawyers, an investigation has found.

This investigation was conducted by 17 media organisations, including the Washington Post and the Guardian, which published a list of more than 50,000 affected phone numbers over the weekend.

The media outlets, known collectively as the Pegasus Project, found that the NSO Group had been selling its Pegasus spyware to the governments of Azerbaijan, Bahrain, Kazakhstan, Mexico, Morocco, Rwanda, Saudi Arabia, Hungary, India, and the United Arab Emirates.

Pegasus was used to extract messages, photos, and emails, as well as to record calls and activate microphones on iOS and Android devices. These included mobile phones belonging to close associates of the murdered journalists Jamal Khashoggi, from the Washington Post, and Cecilio Pineda Birto, a Mexican freelance reporter. Mexico was found to be the NSO Group’s largest client, with over 15,000 affected phone numbers being linked to the country.

The NSO Group denied the allegations, adding that they were considering legal action against the media publications.

“We would like to emphasise that NSO sells it[s] technologies solely to law enforcement and intelligence agencies of vetted governments for the sole purpose of saving lives through preventing crime and terror acts. NSO does not operate the system and has no visibility to the data,” the company stated on its website.

“Our technologies are being used every day to break up pedophilia rings, sex and drug-trafficking rings, locate missing and kidnapped children, locate survivors trapped under collapsed buildings, and protect airspace against disruptive penetration by dangerous drones. Simply put, NSO Group is on a life-saving mission, and the company will faithfully execute this mission undeterred, despite any and all continued attempts to discredit it on false grounds,” it added.

Pegasus Project partner, Amnesty International’s secretary general Agnès Callamard, described the Pegasus spyware as “a weapon of choice for repressive governments seeking to silence journalists, attack activists and crush dissent, placing countless lives in peril”.

“These revelations blow apart any claims by NSO that such attacks are rare and down to rogue use of their technology. While the company claims its spyware is only used for legitimate criminal and terror investigations, it’s clear its technology facilitates systemic abuse. They paint a picture of legitimacy, while profiting from widespread human rights violations,” she added.

Callamard also called for “an immediate moratorium on the export, sale, transfer and use of surveillance technology” until sufficient regulations are set in place.

Last year, it was revealed that Facebook had attempted to purchase NSO Group's Pegasus spyware to monitor iOS users.

Microsoft and CitizenLab have revealed that attacks launched against two recently-patched Windows zero-days were supported by a secretive Israeli-based company that specialises in selling spyware and exploits.

Microsoft believes the vendor named Candiru, codenamed Sourgum, developed spyware dubbed DevilsTongue that unknown clients used to exploit a pair of vulnerabilities the company fixed as part of its latest wave of Patch Tuesday updates.

These are CVE-2021-31979 and CVE-2021-33771, both privilege escalation vulnerabilities that allow attackers to escape browser sandboxes and gain kernel code execution privileges. They were patched on 13 July alongside another exploited zero-day and the PrintNightmare vulnerability.

As part of its investigation, Microsoft identified at least 100 victims based across the Middle East and in the UK and Singapore, including human rights activists, journalists, political dissidents, and politicians.

“Private-sector offensive actors are private companies that manufacture and sell cyberweapons in hacking-as-a-service packages, often to government agencies around the world, to hack into their targets’ computers, phones, network infrastructure, and other devices,” said Microsoft’s Threat Intelligence Centre (MSTIC). “MSTIC believes Sourgum is an Israel-based private-sector offensive actor.

“Citizen Lab asserts with high confidence that Sourgum is an Israeli company commonly known as Candiru. Third-party reports indicate Candiru produces “hacking tools [that] are used to break into computers and servers”.

Citizen Lab’s report reveals that Candiru is a mercenary spyware firm that markets ‘untraceable’ spyware exclusively to government customers, with products including systems that spy on devices and cloud accounts. Its previous customers include Saudi Arabia and the United Arab Emirates.

Candiru appears to license its spyware by the ‘number of concurrent infections’ which would reflect the high number of targets that can be under active surveillance at any one time. The fine print on a product proposal Citizen Lab analysed also suggested there’s a list of restricted countries clients cannot attack, which are the US, Russia, China, Israel, and Iran.

The company is similar in nature to NSO Group, another infamous Israeli company that developed the Pegasus spyware that its clients used to target high-profile WhatsApp accounts in 2019.

Microsoft identified DevilsTonge, the tool used to exploit the two Microsoft zero-days, as a complex, modular, multi-threaded malware written in C and C++ with novel capabilities.

Its main function resides in Dynamic Link Library files that are encrypted on disk, and only decrypted in memory, for example, meaning it’s difficult to detect. Configuration and tasking data is separate from the malware, meaning analysis is hard, while the malware has both user mode and kernel mode capabilities. The malware is also embedded with further evasion mechanisms, although Microsoft is yet to fully analyse the nature of these.

Citizen Lab also identified at least 764 domain names likely in use by Candiru and its clientele to lure victims, with many of these disguised as progressive and charitable organisations like Black Lives Matter and Amnesty International. Other domains were masquerading as media companies and civil-society themed entities.

“Candiru’s apparent widespread presence, and the use of its surveillance technology against global civil society, is a potent reminder that the mercenary spyware industry contains many players and is prone to widespread abuse,” said Citizen Lab researchers Bill Marczak, Kristin Berdan, Bahr Abdul Razzak, and Ron Deibert.

“This case demonstrates, yet again, that in the absence of any international safeguards or strong government export controls, spyware vendors will sell to government clients who will routinely abuse their services. Many governments that are eager to acquire sophisticated surveillance technologies lack robust safeguards over their domestic and foreign security agencies. Many are characterised by poor human rights track records.”

A sophisticated strain of malware capable of stealing user data from infected Android devices is masquerading as the System Update application.

The malicious mobile app, which functions as a Remote Access Trojan (RAT), is part of a sophisticated spyware campaign that has the ability to record audio from devices, take photos, and access WhatsApp messages, according to Zimperium researchers.

Once installed, it registers with its own Firebase command and control (C&C) server, normally used by legitimate Android developers, as well as a second independent C&C server, to send across an initial cache of information. This includes information about whether WhatsApp is installed or not, battery percentage, storage stats, and other information. It can only be installed from a third party store and not the Google Play store.

The malware then receives commands to initiate various actions such as the recording of audio from the microphone or data exfiltration. Researchers have also discovered the malware is capable of inspecting web browsing data, stealing images and videos, monitoring GPS locations, stealing phone contacts and call logs, and exfiltrating device information.

The device also asks permission to enable accessibility services, and abuses this to collect conversations and message details from WhatsApp by scraping the content on the screen after detecting whether the user is accessing the messaging service.

It hides by concealing the icon from the device’s main menu or app drawer, while also posing as the legitimate System Update app to avoid suspicion. When the device’s screen is turned off, the spyware creates a ‘searching for updates’ notification using the Firebase messaging service which allows it to generate push notifications.

The spyware’s functionality is triggered under various conditions, including when a new contact is added, a new text message is received or a new application installed. It does so by exploiting Android’s receivers including ‘contentObserver’ and ‘Broadcast’, which allows communication between the device and the server.

The Firebase messaging service is only used to initiate malicious functions, such as audio recording or data exfiltration, by sending commands to infected devices. The data itself is then collected by the second dedicated C&C server.

The spyware also only collects up-to-date information, with a refresh rate of roughly five minutes for location and networking data. The same applies to photos taken using the device’s camera, but the value is instead set to 40 minutes.

Researchers have so far been unable to determine who is behind the campaign, or whether the hackers are trying to target specific users. Given this spyware can only be downloaded outside of the Google Play store, users are strongly advised not to download applications to their phones from unsafe third-party sources.

Security researchers have discovered a new variant of spyware that's targeting iOS and Android users as part of an international sextortion scam.

According to a blog post by researchers at cyber security firm Lookout, the spyware, called Goontact, has been found in multiple Asian countries and targets users of illicit sites and steals personal information stored on their mobile devices.

Researchers said the types of sites used to distribute these malicious apps and the information exfiltrated suggests that the ultimate goal is extortion or blackmail.

The spyware often disguises itself as secure messaging applications and can exfiltrate a wide range of data, such as device identifiers and phone number, contacts, SMS messages, photos on external storage, and location information.

While it is not presently known who is behind Goontact, it is the newest addition to a crime affiliate’s arsenal, rather than nation-state actors, said researchers.

This fraud begins when potential targets are lured into initiating a conversation on websites offering escort services. Account IDs for secure messaging apps such as KakaoTalk or Telegram are advertised on these sites as the best forms of communication and the individual initiates a conversation.

“In reality, the targets are communicating with Goontact operators. Targets are convinced to install (or sideload) a mobile application on some pretext, such as audio or video problems. The mobile applications in question appears to have no real user functionality, except to steal the victim’s address book, which is then used by the attacker ultimately to extort the target for monetary gain,” said researchers.

Based on investigations carried out by researchers, the campaign has been active since at least 2013. However, the Goontact malware family is novel and is still actively being developed.

“The earliest sample of Goontact observed by Lookout was in November 2018, with matching APK packaging and signing dates, leading us to believe malware development likely started in this time frame,” researchers said.

While the Goontact surveillance apps described in this campaign are not available on Google Play or the Apple App Store, the duration, tactics, and breadth exhibited highlight the lengths to which malicious actors will go to deceive victims and bypass built-in protections.

“It’s no secret that mobile devices are a treasure trove for cyber criminals,” said Phil Hochmuth, programme vice president of Enterprise Mobility at IDC.

“As the use of mobile devices continues to increase, so does the maturity of iOS and Android cybercrime. Now more than ever, consumers must be proactive in avoiding compromise with iOS and Android threat actors whose main objective is to fleece them financially.”

European-based technology vendors must apply for government licenses to export certain ‘dual-use’ products, and consider whether the use of their products in any deal poses a risk to human rights.

New rules established by EU lawmakers and the European Council beef up the export criteria of so-called ‘dual-use’ technologies, meaning vendors will have to clear a much higher bar when striking licensing deals.

These technologies include high-performance computing (HPC), drones, and software such as facial recognition and spyware, spanning systems with civilian applications that can be repurposed for nefarious reasons. They also include certain chemicals.

The beefier update to existing controls includes new criteria to grant or reject export licenses for certain terms, including whether or not the technologies will be used in potential human rights abuses.

The regulation includes guidance for EU nations to “consider the risk of use in connection with internal repression or the commission of serious violations of international human rights and international humanitarian law”. Member states must also be more transparent by publicly disclosing details about the export licenses they grant.

The rules can be swiftly changed to cover emerging technologies, and an EU-wide agreement has also been reached on controlling cyber surveillance products not listed as ‘dual-use’, in order to better safeguard human rights.

“Parliament’s perseverance and assertiveness against a blockade by some member states has paid off: respect for human rights will become an export standard,” said German MEP Bernd Lange. “The revised regulation updates European export controls and adapts to technological progress, new security risks and information on human rights violations.

“This new regulation, in addition to the one on conflict minerals and a future supply chain law, shows that we can shape globalisation according to a clear set of values and binding rules to protect human and labour rights and the environment. This must be the blueprint for future rule-based trade policy.”

Technologies such as facial recognition have attracted major opposition due to the way they’re being used by law enforcement agencies. In light of the Black Lives Matter movement, for instance, a swathe of technology vendors announced they’d be curbing their own facial recognition projects due to the public backlash.

Google has issued a ban on any software that allows an individual to track the whereabouts of other users without their consent, apps often referred to as 'stalkerware'.

As a part of new changes to its Developer Program Policy, Google said that Android apps intending to monitor other users’ behaviour will be obliged to present the tracked user with a persistent notification and unique icon that clearly identifies the app.

They will also be banned from advertising themselves as a "spying or secret surveillance solution” and will be unable to “hide or cloak tracking behavior or attempt to mislead users about such functionality”.

However, the ban, which comes into effect on 1 October, does not apply to apps used by parents to track the whereabouts of their children. Any software that allows companies to track employee devices, such as enterprise management apps, will also be excluded from the ban.

According to David Emms, principal security researcher at Kaspersky, apps which help monitor adults without their permission or knowledge “masquerade as parental control software and call themselves legal that way”.

“The whole category is tricky because we can’t label it as malware and report it as we would a backdoor trojan or similar, because in some jurisdictions it’s legal so it straddles a grey area,” Emms told IT Pro last month.

According to Kaspersky research, the period between January and August 2019 saw over 518,223 cases globally where the company’s protection technologies either registered presence of stalkerware on user devices or detected an attempt to install it – a 373% increase in the same period in 2018.

Apart from the formal ban of stalkerware apps, Google also announced that it would be making changes to its policy in order to tackle the issues of misrepresentation and gambling.

Effective from 21 October, developer accounts will not be allowed to mislead users by impersonating any person or organisation, as well as misrepresenting or concealing their ownership or primary purpose of the app.

Google will also restrict online gambling to the UK, Ireland, France, and Brazil.

For confidential advice, call the National Abuse Helpline on 0808 200 0247 or visit nationaldahelpline.org.uk

A new form of Android spyware has been discovered that uses explicit content and the COVID-19 pandemic to instal remote access malware on mobile devices.

The malicious application is being distributed by a prolific hacking group based in India, dubbed "Transparent Tribe", according to Kaspersky researchers.

The cyber security vendor has been tracking the group for over four years and recent research suggested it had been working to improve its toolset and expand its operation – which now includes mobile threats.

Previous investigations into Transparent Tribe uncovered an Android implant it had distributed in India as either a pornographic clip or as part of a fake national COVID-19 tracking app.

The first application is a modified version of a simple open-source video player you can find on Android, according to Kaspersky. As it's installed, it uses an adult video to distract the user. The second application, known as "Aarogya Setu", is similar to the coronavirus tracking app developed by the government of India's National Informatics Centre – a department under the country's Ministry of Electronics and Information Technology.

Once downloaded, both applications will attempt to install a modified version of an Android-based Remote Access Tool (RAT). This is malware that has been customised by the attackers to extract data.

The researchers spotted the connection between the group and the two applications thanks to the related domains the hackers used to host malicious files for its different campaigns.

"The new findings underline the efforts of the Transparent Tribe members to add new tools that expand their operations even further and reach their victims via different attack vectors, which now include mobile devices," said Giampaolo Dedola, a senior security researcher at Kaspersky's Global Research and Analysis Team.

"We also see that the actor is steadily working on improving and modifying the tools they use. To stay protected from such threats, users need to be more careful than ever in assessing the sources they download content from and make sure that their devices are secure. This is especially relevant to those who know that they might become a target of an APT attack."

A prolific form of Android spying malware was left undetected in the Google Play store for four years and is likely to have affected hundreds of thousands of users, according to the team of researchers who discovered it.

The team from cyber security firm Bitdefender discovered the "highly sophisticated Android espionage platform" earlier this year, although they believe it had been active since 2016, first targeting Android users in Australia and then users in the Americas and Europe, including the UK.

The malware has been further defined as a strain of spyware, which allowed its authors to snoop on any user that downloaded infected apps and access personal data, such as device preferences, the contents of their address books and messages, as well as device usage data and inactivity times.

Researchers have named the spyware 'Mandrake', as the criminals behind it were found to be using names of toxic plants for their development branches.

The team also found that Mandrake conducted phishing attacks on applications including Amazon, Gmail, PayPal, Google Chrome, as well as popular cryptocurrency wallet apps such as Lunoor, Coinbase and numerous banking apps from around the world. UK banks were not listed by Bitdefender among the victims.

The creators of the malware attempted to gain a strong presence on the app market and circumvent Google Play security by publishing their own malicious apps, such as OfficeScanner and CoinCast, and generated fake comments and downloads in order to ensure that their application made it to the trending section of Google Play.

The malware developers went to great lengths to ensure their apps came across as legitimate software, including by engaging with negative reviews and comments, and delivering fixes to the apps.

The marketing behind the malicious apps was so extensive that CoinCast not only had an official website, but also a strong social media presence on Facebook, Twitter, Reddit, and YouTube.

Hackers even tried to evoke trust among its potential victims by listing an address for its OfficeScanner app on its Facebook page, namely the Engineering and Mathematical Sciences Building in Milwaukee, Wisconsin.

Alongside CoinCast and OfficeScanner, Bitdefender also listed Abfix, SnapTune Vid, Currency XE Converter, Horoskope, and Car News as other malicious applications developed by Mandrake operators.

The Bitdefender team estimates "the number of victims in the tens of thousands for the current wave, and probably hundreds of thousands throughout the full 4-year period".

"We can also extrapolate that every victim of Mandrake has most probably been exposed to some form of data theft," they said.

The discovery made by Bitdefender comes weeks after a group of cyber security experts from Cybereason Nocturnus found that a mobile-based trojan was capable of compromising Android's accessibility features in order to steal user data from banking applications and read user's SMS messages, allowing the malware to bypass two-factor authentication.

Workers from Israeli spyware firm NSO Group have filed a lawsuit against Facebook, accusing the social media giant of blocking their private accounts after WhatsApp decided to sue their employer.

Employees with the firm have accused the tech giant of blocking their private accounts on Facebook and Instagram, as well as those of their friends and family members, according to Reuters. The workers have petitioned a court in Tel Aviv for Facebook to unblock the accounts, which was allegedly done without any notice.

WhatsApp, which is owned by Facebook, launched legal action against the developer last month after finding evidence that pointed to its role in providing the tools for government agencies to target individuals through the video calling function.

NSO Group was pinpointed in an attack earlier this year that targeted a litany of users, including journalists and human rights activists as well as senior government and military officials in US-allied nations.

IT Pro approached Facebook for comment, but had not received a response at the time of publication. In a statement to Reuters, however, a company spokesperson said it had disabled "relevant accounts" after attributing a sophisticated cyber attack to the company and its employees. These blocks "continue to be necessary for security reasons, including preventing additional attacks," the spokesperson added.

"Blocking our private accounts is a hurtful and unjust move by Facebook," the statement from NSO Group workers said. "The idea that personal data was searched for and used is very disturbing to us".

Facebook added that it had re-enabled some accounts through an appeals process, but the workers are adamant the initial blanket ban, subject to the lawsuit, was unfair.

The tool over which WhatsApp launched legal action, known as Pegasus, was used by hackers between April and May to manipulate a WhatsApp flaw to track users' communications and location data.

NSO Group is known for developing surveillance technology for national governments and public sector agencies. WhatsApp, when it initially pointed the finger, claimed that companies like NSO Group do not have strict enough restrictions to ensure their products aren't complicit in cyber attacks.

Spyware refers to any software that can be used to track or spy on your activity on a computer, mobile, tablet, or any other digital device.

Often, the term applies to malware that is installed on a computer with a malicious intent to watch a user's actions and replicate them in order to steal data or other information referring to a user. Whether it's the original hacker's intent or not, once a criminal has gained access via spyware, they are able to track anyone's actions on the computer - not just the owner's.

It's normally installed on a device without the user knowing and once it's running, it's often unlikely they'll be able to see anything different happening to their machine or mobile.

Using spyware, hackers can track keystrokes, the websites someone has visited, as well as usernames and passwords for those websites. Other sensitive information a user enters into fields, such as payment details, might also be tracked, with malicious actors aiming to breach accounts and carry out other fraudulent activities.

One of the reasons spyware can be such a problem is not only can it give criminals a way into your computer and the opportunity to steal data, but it can also significantly slow down a user's computer as it tracks everything you do.

Spyware can also be used to redirect web searches to questionable websites (used for phishing, for example), and change the settings of your computer, throttling bandwidth, memory and other processor tasks in the meantime.

There are times when software that acts like spyware is installed for reasons that are not just criminal. Organisations may install tracking software on corporate-owned hardware to track an employee's browsing habits. Parents may also use similar software to spy on their kids' online activity.

Spyware types

Spyware comes in many forms, from adware to keyloggers. Here are some of the most common types and how they work.

Adware

Cyber criminals use adware to spam users with unwanted adverts on their computers, smartphones, and tablets, allowing for the monitoring of users’ browsing activity and the selling of this data to advertisers. Adware is often embedded inside free apps, landing on a user’s device potentially without their knowledge, although software vulnerabilities can also be exploited to achieve the same result.

Keyloggers

With keylogging software, hackers can monitor every keystroke a user makes on their device. Collecting this information allows them to access usernames, passwords, text messages, emails, and other private information that is typed by the victim. Typically, keyloggers will appear in the form of software that hides on a user’s machine and swipes information as it is entered with a keyboard, although they can appear as hardware-based devices inserted into the USB port. Information collected is usually stored in a file and later transmitted to a malicious actor.

Rootkits

Rootkits are software programs that allow cyber criminals to gain control over a victim's computer without their knowledge. As the name suggests, rootkits are collections of tools (kits) that allow hackers to take over the admin (or root) account on a system. This means they can prove incredibly dangerous - the admin access allows hackers to disable programs, delete files, execute malicious software, record user activity, and exfiltrate data. The elevated privileges also allow for persistence, making it difficult to completely remove the infection.

Infostealer

As you can probably guess by its name, infostealers are used to log confidential information such as usernames, passwords, and web cookies before sending it back to the hacker. When cyber criminals get hold of this information, they may list it for sale on the dark web in order to make a profit.

System monitors

These are software programs that allow cyber criminals to monitor all user activity on a compromised device, including the websites and apps people access, emails sent and received, and lots more. They typically capture this information by logging keystrokes and taking screenshots in real time.

Examples of spyware

New spyware campaigns are constantly emerging, with one of the most recent being dubbed CapraRAT by security researchers at SentinelOne. This spyware mainly comes in the form of curated video browsing applications for Android devices. Researchers warned in July that the group had started targeting mobile gamers, weapons enthusiasts, and social media users with four new malicious apps.

In 2023, a spyware campaign dubbed Operation Triangulation was found on the iPhones of a number of people working for cyber security giant Kaspersky. The spyware is believed to have been spread through iMessage, in hope of stealing sensitive information stored on victims’ iPhones. Apple has since issued a security update for this zero-day flaw.

Mayur Upadhyaya — CEO of API security firm APIContext —  warns that spyware campaigns like CapraRAT and Operation Triangulation present a “persistent threat” to users.

“From annoying adware to dangerous keyloggers, rootkits, and info-stealers, spyware's diverse forms pose significant risks,” he says. “The rise of spyware, particularly targeting APIs, highlights the need for vigilance.”

How to protect a business against spyware

When it comes to preventing spyware, an effective method is to improve security protections on each endpoint. The installation of antivirus and antimalware tools will help prevent initial infections, while constant monitoring in the form of endpoint detection and response (EDR) will allow admins to spot and shutdown malicious activity.

Because spyware is often present in free apps and software, the enforcement of application policies that block certain third-party apps stores, and the creation of approved app lists, will help eliminate possible routes for malicious apps.

Software vulnerabilities also provide a means for cyber criminals to install spyware on compromised devices, so you should regularly perform software and security updates. A robust password policy, installing firewalls and virtual private networks, checking app permissions, and security awareness training that covers the dangers of clicking links or attachments in emails are just a few examples of additional measures you can take to limit the spread of spyware.

While many spyware variants can be prevented through good cyber hygiene, some are more difficult to mitigate. David Ruiz, senior privacy advocate at cyber security firm Malwarebytes, uses Pegasus — the spyware software created by Israeli cyber intelligence company NSO Group — as an example of a spyware that currently lacks a “known defense”.

He tells ITPro: “Deployed wantonly by dictatorships and abusive governments, Pegasus is difficult to detect even when it is on a device, and past victims who have worked with Amnesty International and Citizen Lab were forced to simply start over anew when learning that their devices were compromised.”

Huawei employees have allegedly been helping African governments spy on their opposition using its own technology and other spyware to break into encrypted messages and scupper political protests.

Security officials working in direct contact with the Huawei employees have spoken out against those from the embattled Chinese tech giant inserted into the Ugandan and Zambian cyber security forces for helping governments hack, track and halter their opposition, according to a Wall Street Journal investigation.

In one instance, Huawei technicians were allegedly drafted in to help Ugandan cyber surveillance teams intercept encrypted communications sent and received by Bobi Wine, a musician-cum-political activist and highly outspoken opponent of the Ugandan government.

The report revealed that Ugandan security officials unsuccessfully tried for days to hack into Wine's Skype and WhatsApp groups - in which he organised political rallies in coded slang - before turning to Huawei employees for assistance.

"The Huawei technicians worked for two days and helped us puncture through," said one senior officer at the surveillance unit to the WSJ.

The employees who helped hack Wine have since been arrested and their names included in police reports which have been withheld from the wider media.

In hacking the encrypted messages, authorities were able to deploy forces to stop secretly organised street rallies and, in one case, Wine from drafting in 11 lawmakers to speak at one of his concerts.

"It was very clear he was organising a political event, not a music show. We had to act quickly," one of the officials said.

Wine has said the surveillance has spread to his family and has now resorted to alternative tactics in order to stay under the government's radar such as swapping phones and even using devices belonging to members of the public while on the move to evade surveillance.

"The deal with Huawei is a survivor strategy to consolidate power," said Wine. "It's an all-out assault."

It was much the same in Zambia, Huawei technicians, who have now also been arrested but not publicly named, were accused of helping the government break into the phones and Facebook pages of a blogging group which ran a news site publishing criticism of President Edgar Lungu.

According to the WSJ, the operation was conducted out of a surveillance unit in Zambia's telecoms regulator which tracked bloggers locations, ultimately leading to their arrest. It followed an April crackdown, under President Lungu's command, to neuter news sites that published pro-opposition stories after a long period of stable democracy in the country.

The agency responsible for tackling the spread of these damaging stories was Zicta, Zambia's Information and Communications Technology Authority, around half of the staff of which are Huawei employees.

"Whenever we want to track down perpetrators of fake news, we ask Zicta, which is the lead agency," said Antonio Mwanza, Zambia's ruling party spokesperson. "They work with Huawei to ensure that people don't use our telecommunications space to spread fake news."

Huawei first arrived in Africa in 2000, securing the contract for the Ugandan government's sole IT provider eight years later. The report states that after President Museveni expanded digital snooping in 2017, police officers were sent for training in Beijing and then visited Huawei's Shenzhen headquarters to hear about the company's surveillance systems.

Huawei executives allegedly told Uganda to look at Algeria's mass monitoring surveillance systems, supplied by Huawei. Ugandan officers spent time in Algeria doing just that, before co-producing a classified report between Uganda and Algeria titled 'Huawei's intelligent video surveillance system'.

"We completely reject the Wall Street Journal's unfounded and inaccurate allegations against Huawei's business operations in Algeria, Uganda, and Zambia," said Huawei in a statement to IT Pro. "Huawei's code of business conduct prohibits any employees from undertaking any activities that would compromise the data or privacy of our customers or end users, or that would breach any laws.

"Huawei prides itself on its compliance with local laws and regulations in all markets where it operates and we will defend our reputation robustly against such baseless allegations."

However, the revelations come after a period of calm as regards Huawei's reputation as an alleged international cyber espionage outfit, operating on behalf of the Chinese government.

The US has currently placed Huawei on a trade blacklist but in the last few weeks, reports suggested that US companies would be able to apply for licences to once again trade with the tech giant, indicating the White House would loosen its sanctions that have had ramifications on the global supply chain.

A highly sophisticated strain of Android spyware has been discovered which is thought to be linked to a Russian defence contractor previously implicated in the interference of the US 2016 presidential elections.

Researchers from Lookout say the dangerous spyware, known as Monokle, can perform a range of hacking tasks, such as exfiltrating sensitive data, issuing remote access commands on devices, and launching man-in-the-middle attacks (MITM).

The spyware, which has been traced back to the Special Technology Centre (STC), a St. Petersberg-based company with a previously unknown history of developing apps, has been actively infecting users since 2016. Activity has been low in volume but consistent throughout the years, peaking in 2018.

Monokle has so far operated as a trojan, embedding itself into popular apps such as Evernote, Wickr and Skype and then launching a varied list of attack types from a user's machine. It tricks users into downloading it by disguising itself as popular legitimate apps such as encrypted messaging services, productivity boosters and Android update services. It spoofs these apps logos and offers seemingly legitimate functionality.

It's believed that Monokle operates entirely on the Android operating system. While there is evidence of an iOS version in development, researchers said there have been no observed active infections on Apple's operating system to date.

If a user does find themselves infected with this intensely effective and capable strain of spyware, they will be prey to the array of malicious features. The spyware is said to be invisible to an infected device's Process Manager and, because of its remote access trojan (RAT) functionality, it's likely it would record most of your calls and background audio, and keep logs of texts, calls, passwords and pin codes.

Data exfiltration is also a big part of Monokle's functionality. It's said to have the ability to retrieve calendar information, including the date and time of an event, and the description of it. It can also collect account information from some of the most popular social media apps around, including Instagram, WhatsApp and Skype.

In addition, Monokle can retrieve contacts, emails, call and browsing histories, accounts with corresponding passwords and track device location. It can also install attacker-specified certificates to the Android trusted-certificate store, which would allow it to conduct man-in-the-middle (MITM) attacks against TLS traffic.

Researchers were unable to access any of Monokle's exfiltrated data and can only speculate on the potential targets of the spyware, but possibilities listed include those interested in Isalm, interested in or associated with the Ahrar al-Sham militant group in Syria and those living in or associated the Caucasus regions of Eastern Europe - among others.

These guesses were made through inferred information such as the namings of Monokle-infected apps such as 'Ahrar Maps' and 'caucus'. Most apps were written in English but some were also in Russian and Arabic.

The researchers "found strong links that tie STC's Android software development operations to Monokle's indicators of compromise (IOCs) [and] shared command and control infrastructure used by both legitimate and malicious Android applications produced by STC," the report read.

"The Defender application and related software has been referred to by an STC developer as developed 'for a government customer,'" it added.

The report's findings have forced experts to once again raise awareness of the necessity of only downloading verified apps from legitimate sources.

"The Monokle malware mainly infects devices through corrupted versions of legitimate apps," said Paul Bischoff, privacy advocate, Comparitech.com. "For this reason, it's important for all Android users to get apps from a trusted source."

"Avoid downloading apps from third-party app stores and APK downloads," he added. "App developers don't publish their apps on these sites, so they're put there by unknown third parties. The apps from unreputable sources often look identical, but in fact, contain malware."

A vulnerability has been discovered in WhatsApp that allows hackers to covertly install spyware on users' phones and track their communications and even location.

The exploit, which was first reported by The Financial Times, affects both iOS and Android devices and was discovered by WhatsApp earlier this month.

The malware is delivered through a voice call on the app that doesn't even require the user to answer in order for it to be installed, According to a "spyware dealer" who spoke to the FT and WhatsApp. The spyware dealer also claimed that the attacker was then able to delete call logs, so the user may have no idea they were targeted.

It's alleged that the malicious code was developed by NSO Group, a secretive firm based in Israel that's known primarily for developing spyware under the codename Pegasus, which was discovered by the University of Toronto's Citizen Lab and cyber security firm Lookout in 2016.

Pegasus, which is sold to third parties such as government agencies, can turn on a phone's microphone and camera, and collect information from emails and messages as well as picking up location data.

As in 2016, this latest attack seems to have been used primarily to target those working in the field of human rights, with the FT reporting that a UK-based human rights lawyer was targeted on Sunday 12 May.

IT Pro contacted NSO Group for comment, but hadn't received a response at the time of publication. However, the organisation told the FT: "Under no circumstances would NSO be involved in the operating or identifying of targets of its technology, which is solely operated by intelligence and law enforcement agencies.

"NSO would not, or could not, use its technology in its own right to target any person or organisation."

Independent security researcher Graham Cluley told IT Pro it's not surprising that a vulnerability like this had been found and exploited in WhatsApp.

"Any complicated piece of software is going to have bugs. Such a widely-used piece of software like WhatsApp is going to have many more determined parties looking closely at it for vulnerabilities and exploits than something that few people use," he said

He also said it's unsurprising that a specific victim profile had been targeted by whoever has deployed the malware, rather than used to capture data on all or most users.

"Attacks like this aren't typically used against a large number of individuals, but a small, targeted group of victims that are of high value to intelligence agencies and governments," he said.

It's currently not known how long the vulnerability has been in place, however, the company issued a patch for its mobile apps yesterday and is urging all users to upgrade to the latest version as soon as possible. It has also taken steps to deny attackers the ability to use this exploit at an infrastructure level.

In a statement issued to IT Pro, a WhatsApp spokesman said: "WhatsApp encourages people to upgrade to the latest version of our app, as well as keep their mobile operating system up to date, to protect against potential targeted exploits designed to compromise information stored on mobile devices. We are constantly working alongside industry partners to provide the latest security enhancements to help protect our users."

Amnesty International has disclosed how its staff were targeted in a spyware attack launched by what it believes to be "a government hostile to its work".

Alarms sounded in June after an Amnesty researcher received a suspicious WhatsApp message with details of an alleged protest outside the Saudi embassy in Washington DC, along with a link to a website.

An investigation by the charity's technology team revealed clicking this would have installed a surveillance tool called "Pegasus", developed by Israeli-based company NSO Group. The software enables an "extraordinarily invasive form of surveillance" and allows a malicious actor to intercept phone calls, and messages received on the handset, the charity claims.

"NSO Group is known to only sell its spyware to governments. We therefore believe that this was a deliberate attempt to infiltrate Amnesty International by a government hostile to our human rights work," said Amnesty International's head of technology and human rights Joshua Franco.

"This chilling attack on Amnesty International highlights the grave risk posed to activists around the world by this kind of surveillance technology."

Researchers from the University of Toronto's Citizen Lab, which investigates digital espionage among other subjects, corroborated Amnesty's assessment, suggesting the SMS messages Amnesty received contain domain names pointing to websites that appear to be part of NSO Group's Pegasus infrastructure.

Citizen Lab's researchers found the domains social-life.info and akhbar-arabia.com, which appeared on the WhatsApp messages, were consistent with the Pegasus infrastructure they had been tracking since 2016.

The organisation suggest the contents of the WhatsApp message were connected with the organisation's campaigning that week for the release of six women's rights activists being detained in Saudi Arabia. The organisation learned a Saudi Arabian rights activist received a similar message shortly afterwards.

"Can you please cover [the protest] for your brothers detained in Saudi Arabia in front of the Saudi embassy in Washington," the message read. "My brother was detained in Ramadan and I am on a scholarship here so please do not link me to this. [LINK]. Cover the protest now it will start in less than an hour. We need your support please."

Citizen Lab has identified 175 reported such instances of surveillance with ties to NSO in its experience, with up to 150 incidents in Panama alone, as well as reports from the United Arab Emirates, Mexico and Saudi Arabia.

The institution's researchers identified the links as matching websites appearing as part of NSO's new infrastructure that retains a Saudi-focus. They concluded the messages appear to represent attempts to infect the Amnesty researcher and the Saudi activist based abroad with NSO Group's Pegasus spyware.

"NSO Group develops cyber technology to allow government agencies to identify and disrupt terrorist and criminal plots," the Israeli-based company said.

"Our product is intended to be used exclusively for the investigation and prevention of crime and terrorism. Any use of our technology that is counter to that purpose is a violation of our policies, legal contracts, and the values that we stand for as a company.

"If an allegation arises concerning a violation of our contract or inappropriate use of our technology, as Amnesty has offered, we investigate the issue and take appropriate action based on those findings. We welcome any specific information that can assist us in further investigating of the matter."

Researchers have uncovered an emerging cyber threat targeting Android device-owning football supporters just as the 2018 FIFA World Cup reaches its climax.

Believed to be part wider spyware campaign targeting members of the Israeli Defence Force (IDF) dating back to the start of 2018, ClearSky security researchers have discovered a variant aimed at targeting football supporters manifesting as an application named 'Golden Cup'.

Days after the IDF publshed a report blaming "Hamas cyber terrorists" for orchestrating a spyware campaign that lured Israeli soldiers into downloading malicious applications, security researchers have found further samples, manifesting principally as 'Golden Cup', now targeting civilians.

The original spyware campaign initially involved fake Facebook profiles asking IDF soldiers, as part of a seduction process, to download the malicious apps named 'GlanceLove' and 'WinkChat' to continue socialising.

Researchers at Symantec noted that given the original approach was "not a great success", the hacker's latest attempt involved a hurriedly created malicious World Cup app to offer users live scores and fixtures and distribute it to Israeli citizens as well as military personnel.

"We assume it was rushed because, unlike GlanceLove, it lacked any real obfuscation," its researchers Roy Iarchy and Eyal Rynkowski wrote on the cyber security company's official blog.

"Even the C&C [command-and-control] server side was mostly exposed with the file listing available for everyone to traverse through it. It contained approximately 8GB of stolen data."

GoldenCup is a fairly innocent-looking app in that its code is aimed at executing the app's touted functionality as a scores hub, while also being geared towards collecting identifiers and some data from the host device.

Thorugh the use of a phased approach GoldenCup exploits its fairly innocuous design to get past Google's security processes and get listed on the Google Play Store.

After receiving a command from the C&C - communicating using a Message Queuing Telemetry Transport (MQTT) protocol - the app downloads a malicious .dex file that adds additional malicious capabilities. Using this delivery method, its developers can submit a seemingly-legitimate application to the Play Store, adding any malicious elements thereafter.

The first phase involves collecting device information, as well as a list of apps already installed on the device, before the app processes an "install app" command that downloads an encrypted zip file containing a second .dex file.

From this point, the spyware's functions span from collecting more information about the devices to recording phone calls. The attackers can track location, upload images and video files, upload contacts information, upload SMS message history, record audio using the microphone, and use the camera to capture bursts of snapshots.

These can either be run periodically or upon receiving a command from the C&C server.

"We were unable to find technical similarities or infrastructure overlap with a known threat actor," Clear Sky's research team said.

"However, we assess with medium certainty that the threat actor behind this campaign is Arid Viper based on the targeting of Israeli soldiers, type and character of fake personas on Facebook, and previous Arid Viper activity."

The emergence of a World Cup-related cyber threat is in keeping with malicious actors' tendencies to exploit contemporary or widely-talked about events in the public domain.

Researchers at Kaspersky, for instance, detected a rise in phishing attacks tied to the World Cup in the weeks leading up to the event, alongside a general rise in the number of football-related spam - detailing a series of observations including fake lottery win notifications, and emails from attackers impersonating tournament sponsors.

Norton Antivirus, meanwhile, Symantec's parent company, highlighted one example of a fake win phishing email, informing users they have won $1.8 million "In Russia 2018 World Cup Draw", that reached 26,000 users in its first seven days.

Reports out today have revealed the scale and severity of cybercrime threats facing UK businesses - with spyware the number one threat but ransomware and cryptomining detections rising sharply.

The National Cyber Security Centre (NCSC) and National Crime Agency (NCA) counted 34 significant attacks that required a cross-government response between October 2016 and the end of 2017, in addition to 762 less severe attacks across this period, in a joint report released today.

Their report, titled 'The cyber threat to UK businesses 2017-2018', said 2018 would bring further attacks; warning vulnerabilities in Internet of Things (IoT) devices will grow, as well as highlighting the increased threat of crypto-jacking - where hackers force victims' computers to unwittingly mine cryptocurrencies - and the growing temptation for attackers to target sensitive information stored on cloud services.

Major incidents in 2017 included ransomware and distributed denial of service (DDoS) attacks, massive data breaches, supply chain compromises, as well as fake news and information operations.

The NCSC said the risk to UK companies is "bigger than ever", and Ciaran Martin, NCSC chief executive, emphasised the need for public organisations to share knowledge to fend off attacks.

"We are fortunate to be able to draw on the cyber crime fighting expertise of our law enforcement colleagues in the National Crime Agency," he said. "This joint report brings together the combined expertise of the NCA and the NCSC. The key to better cyber security is understanding the problem and taking practical steps to reduce risk."

Raj Samani, chief scientist and fellow at cybersecurity firm McAfee, said sharing knowledge should extend to the private sector too. He said: "The NCSC rightly highlights the importance of collaboration in underpinning the UK's response to cyberattacks. One way to do this in in adopting threat intelligence sharing. In learning about the attacks that other similar organisations are facing, IT and security professionals can ensure that they are prepared to defend against the popular attacks of the day."

Ransomware

Verizon also released its 11th annual Data Breach Investigations Report today, the findings of which may prove somewhat unsurprising for those who have been keeping an eye on the security landscape over the last few years.

Predictably, ransomware was one of the biggest threats, becoming the most commonly-seen form of malware over the course of 2017, up from fourth place the previous year. One notable change, however, is that ransomware infections are increasingly affecting business-critical systems rather than just desktops.

Ali Neal, director of international security solutions at Verizon, told IT Pro that although these results may not be surprising, they are still significant. "We have to call out things whether they're obvious or slightly better-hidden; the ransomware piece is obviously something that's probably pretty obvious to everyone, but it has been notable in the number of incidents that it created."

Also out today was Malwarebytes' quarterly cybercrime report, which outlined that while ransomware detections were up 28% between January and March 2018, it was only the sixth-highest detected threat with the overall volume remaining low - in contrast with the prominence placed on ransomware by the Verizon and NCSC reports, the latter of which highlighted the WannaCry attack as a high-profile example. Among consumers, ransomware detections actually declined 35%, according to Malwarebytes.

Malwarebytes' report said: "If you look at business detections after January, it looks like all malware activity has dropped off the side of a cliff. Spyware and riskware tools plummeted, though spyware retained the top spot by the hair of its chin."

Cryptomining

Among consumers, adware remains the key threat, while cryptomining saw a dramatic increase among business users - with incidents rising a staggering 4,000%, according to Malwarebytes.

The NCSC also identified the growing threat, writing: "We assume the majority of cryptojacking is carried out by cyber criminals, but website owners have also targeted visitors to their website and used the processing power of visitors' CPUs, without their knowledge or consent, to mine cryptocurrency for their own financial gain."

Bitcoin-mining hackers hit thousands of government websites, including the Student Loans Company and other UK government bodies, it was revealed in March.

Phishing

Verizon found that phishing attacks remain a huge attack vector, and combined with financial pretexting, phishing tactics played a part in more than 90% of all breaches investigated last year. In fact, Verizon's report found that businesses are three times more likely to be compromised by a social engineering attack like phishing than by a technical vulnerability in their security.

Neal stated that businesses should be doing more to protect themselves, given that the same attack patterns and trends keep recurring, but noted that the area is a complex one.

"I don't think there's one answer," he said. "Better training has probably got to be point number one, because ultimately it's humans, and that goes to executives who are going to be particularly targeted. I think there is an opportunity to look at better email scanning, better policy enforcement, and there's also a number of technologies out there that can be implemented."

The NCSC highlighted business email compromise (BEC) as a form of phishing attack targeting senior business executives, where hackers impersonate business leaders in an attempt to trick customers, vendors or staff to transfer funds and sensitive information.

"BEC scams are a serious threat to organisations of all sizes and across all sectors, including non-profit organisations and government. It represents one of the fastest growing, lowest cost, highest return cyber crime operations," the report said.

Image: Bigstock

Research into the hack attack against the computer network at the 2018 Winter Olympics has revealed the malware source code was deliberately forged to make it appear as if North Korea was behind the attack.

Olympic officials confirmed at the end of February that days before the opening ceremony in Pyeongchang, South Korea, a devastating malware attack had paralysed the event's IT infrastructure.

The cyber attack, which knocked display monitors, WiFi networks, and the Winter Olympics official website offline, was almost immediately attributed to groups in North Korea, Russia, and China given a number of similarities between the malware and other attacks.

However, an investigation by Kaspersky found evidence of source code that looked identical to the style deployed by the Lazarus Group, a notorious hacking collective with ties to North Korea and named responsible for the hack on Sony Pictures in 2014.

According to the report, the analysed code resulted in a "100% match with previously known Lazarus malware components and zero overlap with any other clean or malicious file known to date to Kaspersky Lab". A number of inconsistencies with the attack, including motivations and tactics normally associated with Lazarus, prompted further investigations into the code, revealing that it had in fact been forged to look like the North Korean group was responsible.

"To our knowledge, the evidence we were able to find was not previously used for attribution. Yet the attackers decided to use it, predicting that someone would find it," said Vitaly Kamluk, head of APAC research team at Kaspersky. "They counted on the fact that forgery of this artefact is very hard to prove."

"It's as if a criminal had stolen someone else' DNA and left it at a crime scene instead of their own. We discovered and proved that the DNA found on the crime scene was dropped there on purpose. We've always said that attribution in cyberspace is very hard as lots of things can be faked, and Olympic Destroyer is a pretty precise illustration of this."

While Kaspersky is unable to say exactly who was behind the Olympic Destroyer malware, it did find that the attackers used NordVPN and a hosting provider called MonoVM to mask their activities, both of which have been previously used by the Russian-speaking Sofacy hacking group.

That would seem to corroborate claims by two anonymous US intelligence sources that claimed the attack originated from Russia, and was made in retaliation against a decision by the Olympic Committee to ban Russian athletes for doping violations.

Yet Kaspersky also suggests the motivations of the hackers are unclear, as it's believed they had admin access to the IT systems and could have devastated Olympic infrastructure as a result, but chose only to do "light" damage by wiping backups and rebooting systems.

The most likely purpose of the attack was to test the malware's ability to fool security researchers in a real-life setting, the results from which will be used to create the perfect "false flags" for future attacks, according to Kaspersky.

26/02/2018: Russian spies 'hacked systems at the 2018 Winter Olympics'

Russian spies hacked into the systems used by authorities at the 2018 Winter Olympics in South Korea, US intelligence sources have claimed.

The military spies reportedly attempted to breach several hundred computers during the global event, and tried to make it look like North Korea did the hacking, something that is known in the security industry as a "false-flag" operation.

While officials in PyeongChang, where the Olympics was held, acknowledged that the Games were hit by a cyber attack during the opening ceremony on 9 February, they refused to confirm who was responsible. The disruption, which saw broadcast systems and the Olympics website hit, made it difficult for many attendees to print their tickets for the ceremony, and thus resulted in many empty seats during the event.

Now two anonymous US intelligence sources have told The Washington Post that the attack came from Russia, believing it was in retaliation against the International Olympic Committee's banning of the Russian team due to doping violations.

This also meant that no Russian Olympic federation officials were allowed to attend the event, and while some athletes were permitted to compete under the designation "Olympic Athletes from Russia", they were unable to display the Russian flag on their uniforms and, if they won medals, their country's anthem would not be played.

Before the end of the event on Sunday, some US officials claimed they were concerned the Russians may try and disrupt the closing ceremonies, they told the Post.

"We're watching it pretty closely," one said. "It's essentially a Korean problem," the official added. "We will help the Koreans as requested."

12/02/2018: Hackers hit 2018 Winter Olympics opening ceremony

A cyber attack disrupted the opening ceremony of the 2018 Winter Olympics on Friday, organisers have revealed.

TV and web broadcasting services were affected in the attack on the Games - hosted in Pyeongchang, South Korea - but officials said that no vital infrastructure had been damaged.

A spokesman for the committee behind the Pyeongchang Games told press on Sunday that "all issues were resolved and recovered yesterday morning".

The International Olympic Committee re-affirmed the integrity of the Games' electronic systems but said little beyond that, declining to reveal the source of the attack.

"We are not going to comment on the issue. It is one we are dealing with. We are making sure our systems are secure and they are secure," IOC spokesman Mark Adams told Reuters, adding that "maintaining secure operations is our purpose".

In the wake of Winter Olympics hack, some have pointed to North Korea's long-standing conflict with its South Korean neighbours, as well as the list of cyber attacks the country is suspected of orchestrating, such as the WannaCry ransomware attack last May.

Others, however, have disputed this interpretation, citing the fact that North Korea is represented at the games, and the two nations marched together at the opening ceremony for the first time in over a decade.

Instead, Russia has been fingered as a potential culprit by some experts, citing the fact that the country has been banned from competing in the Games over doping scandals as a potential motive.

Russia's foreign ministry stated prior to the opening ceremony that any media allegations suggesting Russia would be behind any attacks on the Games would be false. The IOC has also advised Pyeongchang organisers not to reveal the source of the hack, with spokesman Mark Adams stating that "best international practice says that you don't talk about an attack".

Regardless of who is behind the attacks, security experts do not expect them to stop while the Games are underway.

"It is clear attacks are ongoing and are likely to continue throughout the duration of the games," said McAfee senior analyst Ryan Sherstobitoff. "What is yet to be determined is if actors are working simply to gain disruption or if their motives are greater."

Picture: Shutterstock

A hacking operation that has been dubbed 'Dark Caracal' is responsible for stealing private data from thousands of individuals and businesses from more than 21 different countries starting in 2012, according to research by Lookout and Electronic Frontier Foundation (EFF) released last week.

A joint report from the organisations revealed that the spying operation has targeted a range of different platforms but focused on mobile devices, using Android malware called Pallas to steal hundreds of gigabytes of data.

In order to gain access to victims devices, the hackers used phishing techniques to install 'trojanised' versions of messaging apps such as WhatsApp and Signal. Once installed, the Android malware can be used to collect a range of sensitive information including call logs, photos, messages, audio recordings, location data and more.

The professions of victims duped by the operation are incredibly wide-ranging.

"Thus far, we have identified members of the military, government officials, medical practitioners, education professionals, academics, civilians from numerous other fields, and commercial enterprises as targets," the report explained.

What is Dark Caracal?

Dark Caracal is described in the report as having "nation-state level advanced persistent threat (APT) capabilities", but the researchers stop short of explicitly saying it's a state-sponsored operation. However, they do reveal they believe the operation to be run from a Lebanese government building in Beirut, more specifically the headquarters of the General Directorate of General Security.

It's this revelation, along with the the fact many of the operation's different spying campaigns were deemed "seemingly unrelated" by researchers, that suggests Dark Caracal might be a type of government spyware 'for hire', carrying out spying jobs on behalf of a variety of clients.

"We believe the actors would use Pallas against any target a nation state would otherwise attack, including governments, militaries, utilities, financial institutions, manufacturing companies, and defense contractors," a blog post on Lookout's website explains.

EFF and Lookout began investigating Dark Caracal after EFF released its Operation Manul report, which shed light on another spying operation aimed at "journalists, activists, lawyers, and dissidents" who had spoken out against President Nursultan Nazarbayev's regime in Kazakhstan. The researchers spotted that Dark Caracal uses the same "infrastructure" and software as Manul, despite not sharing any of the same targets, bolstering the case that the operation might now have extended to a kind of cybercrime service.

KasperskyLab has uncovered a new security vulnerability affecting Android devices, claiming it's one of the world's most powerful Android spyware tools.

Named 'Skygofree', the threat apparently enables attackers to hack into Android smartphones and tablets and extract WhatsApp messages from victims' devices.

"The malware can also monitor popular apps such as Facebook Messenger, Skype, Viber, and WhatsApp," Kaspersky'sAnna Markovskaya revealed in a blog post. "In the latter case, the developers again showed savvy; the Trojan reads WhatsApp messages through Accessibility Services."

The tool is not a new one, either. While it was only recently discovered, the Russian security giant says it dates back as far as 2014.

Warning of the dangers of the spyware tool,Markovskaya explained that Skygofree can not only take audio from a smartphone's microphone when it's in a certain location, but also force infected devices to surreptitiously connect to a Wi-Fi network and gather even more personal data. This, the firm said, lets it collect and analyse a victim's web traffic, meaning someone somewhere will know exactly what sites they looked at and what logins, passwords, and card numbers they entered.

"The payload uses the Android Accessibility Service to get information directly from the displayed elements on the screen, so it waits for the targeted application to be launched and then parses all nodes to find text messages,"Markovskaya said.

"Essentially, Accessibility Services provide[s] a nice route into other applications as they have permission to do so, via an application programming interface (API)."

In a seperate SecureList blog, Kaspersky security experts concluded thatSkygofree is "one of the most powerful spyware tools that we have ever seen for this platform". Nevertheless, the teamsaid it has only logged a few infections of the tool, and those have all been in Italy. While that doesn't sound very scary unless you live in Italy, the firm said that this doesn't mean that users in other countries can let their guard down, as malware distributors can change their target audience at any moment.

Kaspersky'sMarkovskaya issued three ways users can protect themselves against this advanced Trojan, just like any other infection.

The first is by only installing apps only from official stores and disabling installation of apps from third-party sources, which you can do in your smartphone settings.

The second is by not downloading an app if you're in any doubt whatsoever.

"Pay attention to misspelled app names, small numbers of downloads, or dubious requests for permissions any of these things should raise flags,"Markovskaya also warned.

Finally, she advised that users should install a reliable security solution in order to protect your device from most malicious apps and files, suspicious websites, and dangerous links.

Lenovo cannot install any bloatware on its laptops without customers' express agreement, under the terms of its settlement with the Federal Trade Commission (FTC) over the Superfish scandal.

On top of a $3.5 million fine that the company agreed to pay in September, Lenovo will now be required to obtain express consent from consumers before any preinstalled software is able to run on a laptop, as well as provide an easy means of uninstalling any Lenovo tools.

The decision, announced yesterday, concludes the FTC's long-running complaint against the company, which stated that Lenovo compromised security in order to deliver targeted advertising to its customers.

The company has also agreed to open itself up to regular third party auditing over the next 20 years, part of which will involve the creation of a "comprehensive software security program" that will identify risks to applications, and protect information collected on customers.

In the original complaint against Lenovo, the FTC charged that "beginning in August 2014 Lenovo began selling consumer laptops in the United States that came with a pre-installed advertising software program called VisualDiscovery that interfered with how a user's browser interacted with websites and created serious security vulnerabilities".

It was found that the VisualDiscovery was a modified version of the Superfish adware, a tool that allowed web pages to deliver targeted advertising to users when their mouse hovered over links. The tool was installed on hundreds of thousands of Lenovo machines and advertised as a search assistant to help users find similar products to those shown on screen.

However, VisualDiscovery was found to not only collect vast quantities of user data, such as logins, payment information and social security numbers, but also contained a major security risk that allowed hackers to access the encrypted data sent over the internet.

Following FTC intervention in 2014, 32 US states issued lawsuits against the company that alleged the software violated the regulator's provisions that block misleading practices, prompting Lenovo to pull VisualDiscovery from future machines.

A Lenovo spokesman told IT Pro: "Lenovo has been informed that the FTC has given final approval to the settlement announced in September which now brings this matter to a close."

06/09/2017: Lenovo settles Superfish spyware lawsuit for $3.5m

Lenovo has agreed to settle the Superfish spyware case with the Federal Trade Commission (FTC) and 32 states for $3.5 million.

Lenovo preloaded the bloatware on some of its consumer notebooks which delivered ads to users and risked compromising their security, according to the FTC's charges. The Superfish adware was installed on hundreds of thousands of laptops and potentially allowed hackers to access users' encrypted data when it loaded visual search results into users' browsers, security experts warned back in 2015.

As part of the settlement, Lenovo must not misrepresent preloaded software on its laptops which transmit sensitive data to third-parties, or force users to look at advertising. Instead, it will need user consent before installing this type of software and must also implement a software security program for consumer software on its laptops for the next 20 years.

Lenovo began selling its laptops in August 2014 preloaded with software called VisualDiscovery, which interfered with user's browsers and "created serious security vulnerabilities", the FTC said.

Acting FTC chairman Maureen Ohlhausen said: "Lenovo compromised consumers' privacy when it preloaded software that could access consumers' sensitive information without adequate notice or consent to its use. This conduct is even more serious because the software compromised online security protections that consumers rely on."

Lenovo said it stopped preloading VisualDiscovery into its laptops once it learnt of the issues, and tried to remove the software from existing PCs.

It added: "To date, we are not aware of any actual instances of a third party exploiting the vulnerabilities to gain access to a user's communications. Subsequent to this incident, Lenovo introduced both a policy to limit the amount of pre-installed software it loads on its PCs, and comprehensive security and privacy review processes, actions which are largely consistent with the actions we agreed to take in the settlements announced today."

Superfish inadvertently enabled a "man-in-the-middle" technique, where VisualDiscovery was able to access all of a user's personal information sent over the internet, such as their login details, social security numbers, and even payment information.

VisualDiscovery replaced a website's digital certificate with its own to impersonate SSL-enabled websites, which meant consumers were not warned before they visited potentially malicious websites with invalid digital certificates. This was because the spyware did not verify if a certificate was valid before it replaced it. This would allow hackers to monitor users' every action online, including bank and email activity.

The FTC has previously cracked down on tech support scams that fool users into thinking their computers are infected and charge them money for "fixing" them. It took action against four more companies and their subsidiaries in May, and worked with tech companies such as Apple and Microsoft to prevent the scams and take action against criminals.

More than 450 HP laptop models have a keylogger hidden away in a driver, forcing HP to issue patches for the affected devices.

The keylogger, found in Synaptics' touchpad software, is disabled by default, but hackers could potentially enable it if they had access to a computer by elevating user privileges, said Michael Myng, the researcher who discovered the flaw.

Commericial workstations, consumer laptops and other HP products contain the flaw, including Spectre devices, Pavilion devices, ZBooks and others.

"A potential security vulnerability has been identified with certain versions of Synaptics touchpad drivers that impacts all Synaptics OEM partners," an HP statement on its security bulletin read.

"A party would need administrative privileges in order to take advantage of the vulnerability. Neither Synaptics nor HP has access to customer data as a result of this issue."

Myng discovered the issue when trying to control the backlighting of an HP keyboard, noticing a format string for a keylogger when looking through the keyboard driver. Unable to find an HP laptop to test his findings, he contacted HP directly.

"They replied terrificly [sic] fast, confirmed the presence of the keylogger (which actually was a debug trace) and released an update that removes the trace," he said.

HP claims the keylogger in Synaptics' touchpad was created to debug errors. If activated however, a hacker could track every letter a laptop user typed.

Worth updating with a quick line - they say sorry and working on updating drivers with a patch, don't give people admin access in the meantime

A Synaptics spokesperson apologised for the error and advised users to change their admin settings to prevent anyone taking advantage of the flaw before it's fixed.

"Synaptics is working closely with our PC customers to update drivers and to deploy them to address security concerns," they said. "Synaptics also recommends using best practices by restricting admin access to any system as anyone with this level of access can potentially install malware or other anti-privacy software irrespective of whether the debug tool is on or off."

They added: "In our new normal of heightened concern for security and privacy, Synaptics would like to apologise for any concerns that our debug tool may have raised. We have a path to immediately address this issue and other security concerns should they arise."

A keylogger was also discovered in Synaptics subsidiary Conexant's audio drivers, also installed in HP laptops, back in May.

An HP spokesperson said: "HP was advised of an issue that exists with Synaptics' touchpad drivers that impacts all Synaptics OEM partners. HP uses Synaptics' touchpads in some of its mobile PCs and has worked with Synaptics to provide fixes to their error for impacted HP systems, available in the security bulletin on HP.com. HP has no access to customer data as a result of this issue."

Picture: HP Spectre x360/Credit: IT Pro

The UK is set to lose access to the European Cybercrime Centre, after it was revealed the country will no longer be a member of Europol following its departure from the European Union in 2019.

The European Cybercrime Centre - also known as EC3 - was set up by the cross-border law enforcement group to provide support for EU police forces in tackling cyber crime. EC3 assists national police with intelligence, digital forensics and strategy support, collaborating on cases involving technological elements.

Cyber security experts have expressed dismay at the news. "This is hugely disappointing," McAfee's chief scientist Raj Samani told IT Pro. "Europol have a proven record of success and one would hope a degree of compromise can be reached since the safety of all citizens across the globe is our joint mission."

The government had stated earlier this year that it wished to continue its relationship with Europol following Brexit, but the EU's top negotiator Michel Barnier said that access to Europol would not be possible once the UK leaves the EU, stating that it was a "logical consequence".

Losing access to EC3 will mean that UK police units fighting cyber crime will no longer benefit from intelligence-sharing between EU member states, as well as from the extensive support network offered by Europol's cyber specialists.

"Since before the referendum, the NCA and its partners in policing and wider law enforcement have clearly stated our need to work closely and at speed with European countries to keep people in the UK safe from threats including organised crime, child sexual abuse, cyber attack, and terrorism," a spokesman for the UK's National Crime Agency told IT Pro.

"We are confident that these requirements are being taken into account, and that there is broad consensus on the need to retain our ability to share intelligence, biometrics and other data at speed. It is also vital to ensure we can continue to provide a quick, efficient and dynamic response to crime and criminals impacting the UK and its citizens, be it from serious and organised transnational crime or local level volume crime at the heart of UK communities."

Bugs in the underlying firmware of multiple Intel chip families have left laptops, servers and storage appliances vulnerable to a number of security vulnerabilities, the company has admitted.

The silicon giant has confirmed reports from third-party security researchers that flaws in its chips' management and administration functions could potentially allow hackers to execute code, exfiltrate confidential data and more.

Intel launched a full internal review of its source code after it was alerted to the issues, finding that bugs in affected systems could allow attackers to "load and execute arbitrary code outside the visibility of the user and operating system [and] cause a system crash or system instability".

The flaws affect a wide variety of chip families, including 6th, 7th and 8th Generation Intel Core processors, Intel Xeon E3-1200 v5 and v6 processors, Intel Xeon Scalable processors, Intel Xeon W processors, Intel Atom C3000 processors, Apollo Lake Intel Atom E3900 series, Apollo Lake Intel Pentiums, and Celeron N and J series processors.

This covers everything from laptops and 2-in-1s, all the way up to high-end servers and storage appliances. The company has released a free detection tool, which users and sysadmins can run to identify vulnerable machines. IT Pro has contacted Intel to try and determine the number of affected systems.

Three elements of Intel's firmware are vulnerable: the company's Management Engine (ME) Server Platform Services (SPS) and Trusted Execution Engine (TXE). The Management Engine runs underneath the OS, and is used by admins to remotely access a system for maintenance and management tasks. The Server Platform Services feature is based on the ME and offers similar features for server products, while the TXE deals with hardware authentication.

The ME allows anyone with the appropriate credentials to control desktops, make changes to the system's settings and configurations, and even reinstall the OS. This makes it a very useful tool for IT staff at large companies with multiple offices, but it also means it holds a huge amount of power that hackers could take control of.

Because it runs underneath the OS, the ME is invisible to any antivirus systems or hypervisors installed on the machine. Coupled with its highly-privileged status, this means that a compromised ME could be used to install malware, among other troubling things.

A security advisory issued by Intel stated that 80% of the ten CVEs relating to the flaws are designated as high-severity, with buffer overflows and privilege escalations seen throughout.

"Based on the items identified through the comprehensive security review," the advisory read, "an attacker could gain unauthorized access to platform, Intel ME feature, and 3rd party secrets protected by the Intel Management Engine (ME), Intel Server Platform Service (SPS), or Intel Trusted Execution Engine (TXE)."

Intel has confirmed to IT Pro that patches are now available for affected systems, and the company advised that they should be installed as a matter of urgency.

"We worked with equipment manufacturers on firmware and software updates addressing these vulnerabilities," Intel said, "and these updates are available now. Businesses, systems administrators, and system owners using computers or devices that incorporate these Intel products should check with their equipment manufacturers or vendors for updates for their systems, and apply any applicable updates as soon as possible."

Open source software vendor Mozilla has issued a cease and desist notice to Gamma International for producing spyware that allegedly passes itself off as its flagship web browser Firefox.

In a recent blog post, Alex Fowler, global privacy and public policy leader at Mozilla, stated: "We cannot abide a software company using our name to disguise online surveillance tools that can be and in several cases actually have been used by Gamma's customers to violate citizens' human rights and online privacy.

"As an open source project trusted by hundreds of millions of people around the world, defending Mozilla's trademarks from this type of abuse is vital to our brand, our users and the continued success of our mission," he added.

Spyware is a type of software that tracks and gathers information about users, generally without their consent or knowledge.

Beyond data collection, spyware can also make computers vulnerable to attacks by malware and other infections.

According to Mozilla, Gamma international's software tricks users into thinking they are using the legitimate Firefox program by misrepresenting itself as "Firefox.exe".

"Not only are these activities illegal, but we take them seriously because they are deceptive, harm users, cause consumer confusion, and jeopardise Mozilla's reputation," said Fowler.

However, Mozilla has also stressed that Gamma's Spyware is entirely separate from Firefox, and does not affect the browser itself.

Gamma International had not responded to IT Pro's request for comment at the time of writing.

The USA has been accused of hacking into the French government's computer network, in what has been called an "unprecedented cyber attack between allies."

The alleged attack took place on 6 May 2012, during the second round of the French presidential election, nine days before Nicolas Sarkozy lost out to Franois Hollande.

A second attack is also claimed to have been carried out on 15 May, the day Hollande took power.

French magazine L'Express claims the initial security breach occurred after one or more workers at the Elyse Palace clicked on a fake intranet link delivered to them via Facebook's messaging service.

Sources told the publication the hackers passed themselves off as friends of people working for the presidential palace, then invited them to connect to the Palace's intranet via a false link.

The attackers were then able to retrieve the user's log-in details and enter the governmental network "in complete confidence".

Using the stolen details, the hackers allegedly deployed a spyware Trojan similar to the Flame malware, which affected computers of the Iranian Oil Ministry.

Flame was jointly developed by the NSA, CIA and Israeli military, according to the Washington Post, and experts speaking to L'Express claim the attack on the Elyse could only have come from the US government.

The worm infected a handful of machines, however L'Expresse claims some of the people highest up in the Sarkozy government were among those affected, including secretary general Zavier Musca.

The president himself only escaped infection as he did not use a PC.

Mitchell Moss, spokesman for the American embassy in Paris, said in a statement: "We categorically refute the allegations ... [that] the government of the United States of America participated in a cyberattack against the French government. France is one of our closest allies."

The French government declined to comment.

Spyware developed and sold by a UK-based company has been used to snoop on dissidents in autocratic regimes, according to two security researchers.

The software, legitimately produced and sold by British firm Gamma International, has somehow managed to find its way into the hands of some of the most repressive governments in the world.

According to Google security researcher Morgan Marquis-Boire and Berkeley student Bill Marczak, the spyware was found in email attachments sent to several activists in Bahrain.

Their investigation found the spyware infected not just PCs but a range of devices running popular mobile operating systems, such as iOS, Android, RIM, Symbian, and Windows Phone 7.

The spyware boasts capabilities such as live surveillance via "silent calls" and location tracking. It also has the ability to track all forms of communication, including emails and voice calls as well as cameras and microphones.

A study carried out by University of Toronto Munk School of Global Affairs' Citizen Lab found an application that purports to be FinSpy, a piece of commercial spyware sold to countries for criminal investigations.

Gamma Group, the German parent of UK-based Gamma International, developed FinSpy. Gamma's managing director Martin Muench told Bloomberg that the company had no involvement whatsoever in selling the software to despotic regimes.

"We don't normally discuss our clients but given this unique situation it's only fair to say that Gamma has never sold their products to Bahrain," said Muench.

"It is unlikely that it was an installed system used by one of our clients but rather that a copy of an old FinSpy demo version was made during a presentation and that this copy was modified and then used elsewhere."

Muench said his company could not confirm that software analysed by Citizen Lab was Gamma's product. He added that a modification would have been made to the software as "no message sent to our server when the demo product was used against a real target."

Marquis-Boire and Marczak told the New York Times that they found a connection to Gamma in these code samples. The spyware running on Symbian phones uses a certificate issued to Cyan Engineering, a website registered in the name of Johnny Geds.

Muench confirmed that Gamma employs someone of that name in sales but declined to make further comment.

Security researchers have warned about the existence of new spyware that creates a Firefox add-on, which can monitor users' search activities.

The spyware initially pretends to be an Adobe Flash Player update and, when executed on a user's computer, creates a Firefox add-on called Adobe Flash Player 0.2'. It was said to appear through forum posts.

Trend Micro's Jonathan Leopando said in a blog post that it had a disturbing "capability to monitor the user's browsing activities, particularly his/her Google search queries using the Firefox browser. It then sends the information it gathers to http://{BLOCKED}jupdate.com."

The add-on could also inject advertisements into a Google search results page.

Leopando said malware had historically generally targeted Internet Explorer, which is why many users opt forother browsers like Firefox, Chrome and Safari.

He said: "Though this used to be considered a safe computing practice before, it seems it no longer is with the proliferation of malware targeting the most popular alternative internet browser- Firefox."

Barclays Bank will offer free security software to all of its two million online customers.

It is the latest move by a high street bank to improve customer security that has seen banks issuing savers with security tokens and introducing multi-stage logins to online banking sites.

Barclays will be offering Kaspersky's Internet Security Suite, which normally costs 51 for an annual subscription, as a free download from its online banking website. The suite features anti-virus software as well as spyware, adware, a firewall, parental controls and spam filters.

Barclays has signed a two year deal with Kaspersky. Customers will be able to install the software on three separate computers with each licence.

Barclays deployed a two-factor authentication system called PINsentry in 2007 which was aimed at protecting against phishing and fraudsters. One million PINsentry readers have already been sent out to customers according to the bank.

"For the last two years we have offered customers free anti-virus software, but as internet fraudsters become more sophisticated it is important that customers protect their computers from all threats and not just viruses," said Sean Glichrist, director of digital banking at Barclays.

McAfee has reported what it claims is the most significant malware outbreak in three years, with more than 500,000 detections of a Trojan horse which masquerades as a media file.

A number of fake video and music files have been deliberately spread over peer-to-peer file sharing services like Limewire and eDonkey. These were malicious MP3 and MPEG files triggering the download of an application which served ads to the infected computer.

"People were downloading these files hoping it was music, but it was a media file format that allowed you to link to another site where you downloaded additional files," said Toralv Dirro, security strategist at McAfee Avert Labs.

"Those files downloaded turned out to adware that in some cases even asked the user to accept an end user licence agreement prior to installing."

McAfee saw this as 'medium' risk, with no other malware receiving that risk rating since 2005 as all others were rated less severe.

The security vendor claimed that it was the most prevalent piece of malware in the last three years, and that it had never seen a threat this significant come as a media file.

The huge figure came from retail users that had the option to submit data on what viruses and adware was detected on their computer to McAfee and made publicly available.

Dirro said: "We are currently seeing that the distribution is still going on. It is now at about 580,000 where files have been detected, so people are continuing to download and share these files."

The strategist said that these only reported the incidents that were actually detected, and the real number of users and computers affected would be much higher.

He said that although the damage in this case was not too serious as it was only adware, it could have been much worse and what McAfee were now afraid of in the future was attackers with a more sinister agenda.

"They could try and copycat this attempt as they have seen it is a very successful way to distribute malware," Dirro said. "In the future we are pretty much expecting this distribution method a lot more."

Dirro said that instead of pointing to adware, it could lead users to spyware which would instead try to steal people's data. Instead of being a multimedia file it could take the form of a directly executable one.

"It has happened in the past, but not anywhere close to this scale," Dirro said of the peer-to-peer nature of the attack.