Predator

The details for the vaccination appointment in the infected text message were correct, indicating that someone had reviewed the authentic earlier confirmation and drafted the infected message accordingly.

there had been an attempt to infect his phone with Predator, a piece of surveillance software developed by Cytrox, now part of Greek company Intellexa.

If a target clicked on the malicious web links, they would have been directed to a landing page “identical to the one TAG examined in the Heliconia framework developed by commercial spyware vendor Variston.”

The hackers used a set of vulnerabilities chained together and delivered via one-time web links sent to the targets by text message.

A 2023 investigation by news outlets working with the European Investigative Collaborations group found that Vietnamese officials tried to hack U.S. politicians and journalists using Predator spyware.

Citizen Lab said Nour was sent a malicious link over WhatsApp. When opened, the spyware can access a phone’s cameras and microphone and can exfiltrate the phone’s data.

From a technical perspective, such spyware campaigns often rely on zero-click exploits, baseband vulnerabilities, or malicious configuration profiles to gain persistent access to mobile systems.

From a technical perspective, such spyware campaigns often rely on zero-click exploits, baseband vulnerabilities, or malicious configuration profiles to gain persistent access to mobile systems.

Hooking the ioctl() API in the libbinder.so using an open-source library called xHook is one of the means it uses to communicate with PREDATOR... ALIEN attempts to hook the following APIs in the audio libraries being used by a process.

Citizen Lab said the spyware can survive a reboot of an iPhone — typically clearing any spyware lurking in its memory — by creating an automation using the Shortcuts feature built into iOS.

For example, the implant can inject code that was read earlier from “/system/fonts/NotoColorEmoji.ttf” into the system_server process memory for execution... The overall injection process is achieved using ptrace() and mmap() to inject the code into the target process.

For privilege escalation, the spyware is configured to use a method called QUAILEGGS, or, if QUAILEGGS is not present, it will use a different method called “kmem.” ... We assess that QUAILEGGS likely exploits the aforementioned zero-day vulnerability CVE-2021-1048.

Citizen Lab said the spyware can survive a reboot of an iPhone — typically clearing any spyware lurking in its memory — by creating an automation using the Shortcuts feature built into iOS.

Each of these call chains set up a process structure used to intercept specific ioctl commands, where the spyware uses the functionality of that process to abuse the SELinux context to grant different functionality to the other processes.

Most of the posts on X ... 'often included links that mimicked news sites.'

For example, the implant can inject code that was read earlier from “/system/fonts/NotoColorEmoji.ttf” into the system_server process memory for execution... The overall injection process is achieved using ptrace() and mmap() to inject the code into the target process.

If tcore fails to load, the loader deletes the downloaded encrypted SQLite3 file. It first tries to delete the file, and if that fails, attempts to open the file for write operations and write zero bytes to it to wipe it clean.

The DEX file thus uses these hooks for two key purposes: Hiding Applications/packages : The plugin in the DEX can hook and filter out a specific package/application name from the list of installed packages and applications.

From a technical perspective, such spyware campaigns often rely on zero-click exploits, baseband vulnerabilities, or malicious configuration profiles to gain persistent access to mobile systems.

Hooking the ioctl() API in the libbinder.so using an open-source library called xHook is one of the means it uses to communicate with PREDATOR... ALIEN attempts to hook the following APIs in the audio libraries being used by a process.

During the initialization, it starts the download and calls its main_exec() function by importing it using dlsym(), thus initializing the main component of the spyware.

Once deployed, the spyware can access encrypted messaging apps, capture keystrokes, activate microphones and cameras, and exfiltrate stored files.

The Predator malware has the ability to access every message, call, photo, and password on a mobile phone, as well as the ability to open the phone’s camera and microphone – turning any device into a mobile surveillance bug.

From a technical perspective, such spyware campaigns often rely on zero-click exploits, baseband vulnerabilities, or malicious configuration profiles to gain persistent access to mobile systems.

The spyware uses a variety of sources to gather information about the system. It will enumerate various directories on the file system and read multiple files to extract as much statically available data from the infected device.

Once deployed, the spyware can access encrypted messaging apps, capture keystrokes, activate microphones and cameras, and exfiltrate stored files.

Once deployed, the spyware can access encrypted messaging apps, capture keystrokes, activate microphones and cameras, and exfiltrate stored files.

The operation involved the implantation and activation of malicious software capable of extracting sensitive data, intercepting communications, and conducting unauthorized audio and video recordings.

The operation involved the implantation and activation of malicious software capable of extracting sensitive data, intercepting communications, and conducting unauthorized audio and video recordings.

The operation involved the implantation and activation of malicious software capable of extracting sensitive data, intercepting communications, and conducting unauthorized audio and video recordings.

The ALIEN component configuration contains the URL to download the PREDATOR component... If needed, it will download the PREDATOR component from a hosting site defined in the configuration.

The agency stated that the campaign was orchestrated by unidentified foreign intelligence services and aimed at covert surveillance and data exfiltration.