Loading story…
Italian surveillance vendor Hacking Team was breached and roughly 400GB of internal data was dumped online, exposing source code, emails, customer records, and exploit details tied to its Remote Control System (RCS) spyware platform. Researchers reviewing the leak found multiple offensive capabilities, including an unpatched Adobe Flash remote code execution flaw later tracked as a major zero-day risk, alongside other exploits targeting Flash and Windows. The leaked material also showed Hacking Team had developed techniques to compromise targets using tools such as the Tor Browser, while the company told customers it expected their surveillance operations to resume soon despite the breach.
The documents triggered broad scrutiny of Hacking Team’s business with government agencies worldwide, including reported sales or support tied to Sudan, Ethiopia, Russia, Mexico, South Korea, and Serbia, as well as numerous other police, intelligence, and security bodies. Reporting on the leak linked the company to clients accused of domestic spying, election-related surveillance, and monitoring journalists and dissidents, including South Korea’s NIS and multiple Mexican agencies. The fallout reached Hacking Team’s Western customers as well, with the DEA canceling its contract, while critics argued the records showed the company had supplied intrusive spyware to agencies associated with repression and possible export-control violations.
Trace attribution and downstream blast radius.
14 events from the most recent confirmed update back to the earliest known activity.
The South Korean controversy deepened when an NIS agent linked to the spyware operation was found dead after deleting files related to the hacking programs, prompting calls for investigation.
Leaked material indicated South Korea's National Intelligence Service purchased multiple RCS licenses in 2012, including 35 additional lines shortly before the country's presidential election.
Vice reported that the U.S. Drug Enforcement Administration terminated its contract with Hacking Team in the aftermath of the company's breach and disclosures.
Reporting based on the leaked materials described how Hacking Team developed spyware that enabled monitoring of Tor Browser users, including use in an FBI-linked operation.
After the breach, Hacking Team informed customers that it expected them to be able to resume surveillance operations soon despite the disruption caused by the data dump.
Documents from the breach showed numerous Mexican government bodies had purchased Hacking Team's RCS spyware, with reporting describing Mexico as the company's top customer.
Leaked emails showed Hacking Team renewed a license with Ethiopia's Information Network Security Agency after reports that the agency had used the software against journalists.
Leaked emails cited in the coverage showed Hacking Team sold its surveillance software to Sudan, a deal that drew scrutiny because of UN sanctions and Sudan's human rights record.
Reporting on the leaked emails highlighted Hacking Team's defense of selling intrusive spyware to governments accused of abuses, especially Sudan and Ethiopia, and amplified backlash over its customer vetting.
Security researchers analyzing the leaked data identified an Adobe Flash Player zero-day and verified a proof-of-concept exploit against a fully patched version, warning that public disclosure increased the risk of weaponization.
Analysis of the dumped documents revealed Hacking Team had sold surveillance tools to governments and agencies in countries such as Sudan, Bahrain, Kazakhstan, Ethiopia, Mexico, and Russia-linked entities, prompting broad criticism.
Attackers compromised Italian surveillance vendor Hacking Team and released roughly 400GB of internal data, exposing emails, source code, and customer information.
Leaked emails indicated the NIS tested Hacking Team's Tactical Network Injection capability in 2014 ahead of regional elections, expanding the South Korean spyware scandal.
According to leaked correspondence described in the reporting, Hacking Team stopped selling to Sudan in 2014 after pressure from a UN panel.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
24 references tracked. Mallory keeps watching after this page renders.
theguardian.com
Open sourceweb.archive.org
Open sourcevice.com
Open sourcewikileaks.org
Open sourcewikileaks.org
Open sourcewikileaks.org
Open sourcewikileaks.org
Open sourcewikileaks.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Citizen Lab reported that Hacking Team’s **Remote Control System (RCS)**, a commercial spyware platform marketed as “untraceable” and sold to governments, could be mapped through analysis of its proxy-chain infrastructure. The research linked suspected current or former RCS use to 21 governments, including **Azerbaijan, Egypt, Ethiopia, Italy, Mexico, Morocco, Saudi Arabia, Sudan, Turkey, the UAE, and Uzbekistan**, and showed how traffic passed through intermediary servers before reaching government-operated endpoints. The report also tied exploit-laden documents and shared staging behavior to a likely common commercial exploit supplier, while documenting attacks against dissidents, journalists, and activists such as **Mamfakinch** in Morocco, **Ahmed Mansoor** in the UAE, and Ethiopian journalists in Washington, DC. Separate technical analysis presented by ESET found that Hacking Team’s spyware development continued after the company’s 2015 breach, with post-leak **RCS** samples compiled between 2015 and 2017 observed in 14 countries. Researchers said the malware preserved Hacking Team’s two-stage **Scout** and **Soldier/Elite** architecture and surveillance functions including screenshot capture, password theft, keylogging, camera activation, Skype call recording, and Wi-Fi-based geolocation. Attribution to Hacking Team developers was supported by code continuity, compilation patterns, versioning, and a chain of six signing certificates, including certificates linked to co-founder **Valeriano Bedeschi**, indicating the company’s spyware ecosystem remained active despite public exposure and source-code leakage.
Aug 15, 2026
Investigations and legal filings described a growing **mercenary spyware** market in which private vendors developed and sold intrusion capabilities to government customers, with **NSO Group** emerging as the best-known example but not the only one. Reporting tied NSO’s **Pegasus** spyware to attacks on activists, journalists, and government personnel, including the targeting of UAE activist Ahmed Mansoor and more than **1,400 devices** via a WhatsApp exploit that reportedly required no answer from the victim. Microsoft, Google, Cisco, GitHub, LinkedIn, VMware, and others backed WhatsApp’s lawsuit against NSO, arguing the company should not receive sovereign immunity for operating as a private offensive cyber actor, while broader reporting said Facebook had identified **seven** spyware firms targeting roughly **50,000** people across its platforms. Separate investigations showed the industry stretching beyond NSO into Europe and Asia. Lighthouse Reports linked Italy’s **RCS Lab** and its Tykelab unit to covert mobile-phone tracking through telecom signaling weaknesses and to **Hermit** spyware infrastructure, while Citizen Lab and Motherboard connected a fake WhatsApp phishing campaign to Italian vendor **Cy4Gate** and its **Epeius** lawful-intercept product. Earlier reporting on **Hacking Team** and allegations about **APT17** selling stolen data underscored how surveillance and intrusion capabilities have been commercialized, repackaged, and marketed across borders, despite repeated scandals, lawsuits, and sanctions aimed at curbing abuse.
Aug 15, 2026
Chinese cybersecurity firm KnownSec suffered a significant data breach, resulting in the leak of over 12,000 internal documents. The files, briefly posted on GitHub before removal, reportedly include details on KnownSec's contracts with Chinese government and military entities, internal hacking tools, and a spreadsheet listing 80 overseas targets. Analysis of the leaked data suggests the presence of remote access trojans (RATs) capable of compromising Linux, Windows, macOS, iOS, and Android systems, with some tools able to extract data from popular messaging apps such as Telegram and Chinese platforms. The breach also exposed large datasets, including 95GB of Indian immigration data, 3TB of call records from South Korea's LG U Plus, and 459GB of Taiwanese road planning data. Security researchers and analysts have described the leak as an intelligence gold mine, providing rare insight into the operations of a major Chinese cyber contractor. While the exact motivation behind the leak remains unclear—whether it was the act of a disgruntled insider or an external hack-and-dump operation—the incident highlights the scale and scope of KnownSec's cyber activities, including its role in mapping foreign digital infrastructure and developing tools for state-sponsored operations. The exposure of these documents is likely to have significant implications for both Chinese cyber operations and the security of the affected international targets.
Jun 29, 2026