Heliconia

Heliconia is an exploitation framework linked by Google Threat Analysis Group (TAG) to the Barcelona-based commercial spyware vendor Variston IT. Google reported that the framework enables spyware installation on targeted devices and comprises at least three exploit frameworks: a Chrome exploit chain that abuses a renderer bug to escape the browser sandbox and execute malware on the host OS, a malicious PDF chain exploiting Microsoft Defender on Windows, and a Firefox exploit framework targeting Windows and Linux. Google said the Firefox component affected Firefox versions 64 through 68, suggesting possible use as early as December 2018. TAG stated it had not directly observed Heliconia exploitation in the wild at the time of its 2022 disclosure, but assessed the vulnerabilities were likely first used as zero-days and later as n-days before Google, Microsoft, and Mozilla patched them in 2021 and 2022.

Subsequent reporting tied Heliconia infrastructure and landing pages to additional spyware operations. Google reported that a December 2022 campaign targeting users in the United Arab Emirates used one-time SMS links leading to a landing page identical to one previously examined in the Heliconia framework. That Android exploit chain targeted Samsung Internet Browser and used multiple vulnerabilities, including CVE-2022-4262, CVE-2022-3038, CVE-2022-22706, and CVE-2023-0266, ultimately installing a fully featured C++ Android spyware suite with libraries for decrypting and capturing data from chat and browser applications. Related indicators included the domains www.sufficeconfigure[.]com and www.anglesyen[.]org, and Android system properties sys.brand.note, sys.brand.notes, and sys.brand.doc. Google assessed the operator may have been a Variston customer, partner, or close collaborator.

Google also reported that in March 2023 a government customer used Variston tooling against iPhone users in Indonesia via SMS messages containing malicious links. After infection, victims were redirected to a legitimate Pikiran Rakyat news article. Google further stated that UAE-based Protect Electronic Systems combined spyware it develops with Variston’s Heliconia framework and infrastructure into packages sold to brokers or directly to government customers.

High-confidence associations in the content connect Heliconia to the commercial spyware market and to surveillance use against targeted individuals. The reporting places Variston alongside other commercial surveillance vendors and notes that such tooling has been linked broadly to surveillance of journalists, dissidents, politicians, and other high-risk users. The content does not provide a standalone Heliconia malware payload family name beyond the framework itself, but consistently describes Heliconia as the exploit and delivery framework used to install spyware on Windows, Linux, Android, and iPhone targets through browser, PDF, and SMS-delivered malicious-link vectors.