Loading story…
Researchers reported that malware allegedly used by German authorities for lawful interception included capabilities far beyond court-permitted wiretapping. Analysis of samples released publicly after allegations by the Chaos Computer Club showed the spyware could perform keylogging, capture screenshots, record audio, remotely control infected systems, exfiltrate data, and download and execute additional files, raising concerns that its functionality exceeded Germany’s legal surveillance boundaries.
ESET identified the sample as Win32/R2D2.A after finding the transmission string C3PO-r2d2-POE in the malware. The report noted anecdotal links to Bavarian contractor DigiTask but said binary analysis alone could not conclusively attribute the malware’s origin. It also argued that antivirus vendors should detect such software if it behaves maliciously, regardless of whether it was allegedly built for law enforcement, and highlighted broader legal and ethical tensions over government spyware and privacy protections.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
ESET identified the malware as Win32/R2D2.A based on a transmission string containing "C3PO-r2d2-POE." The report noted anecdotal links to Bavarian contractor DigiTask but said binary analysis alone could not conclusively establish the malware's origin.
Analysis of the released samples showed capabilities including keylogging, screenshot capture, audio recording, data exfiltration, remote control, and the ability to download and execute additional files. These features suggested functionality beyond narrow wiretapping and intensified legal and ethical scrutiny.
The Chaos Computer Club reported that German authorities had used a so-called government trojan for lawful interception and publicly released malware samples for independent analysis. The allegations raised concerns that the software exceeded the scope of surveillance permitted under German law.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
German lawmakers are advancing draft legislation to significantly expand the Bundesnachrichtendienst’s (**BND**) hacking and surveillance authorities, including intercepting full internet communications (not just metadata), retaining collected data for up to six months, and extending the agency’s offensive mandate to hack foreign internet service providers to obtain target information when companies do not cooperate. Reporting indicates the proposal is partly aimed at reducing reliance on the US **NSA** for threat intelligence and bringing Germany’s capabilities in line with other European services; it would also broaden who can be surveilled, including foreigners inside Germany and certain journalists tied to foreign state-run media, and would enable intrusive operations such as deploying a “federal trojan.” Separately, Ukrainian and German law enforcement reported disrupting a Russian-affiliated ransomware operation, identifying and searching two suspects in Ukraine alleged to have served as “hash cracker” specialists who extracted/cracked password hashes, used stolen credentials for lateral movement and privilege escalation, and supported ransomware deployment and data exfiltration for extortion. Authorities seized digital devices and cryptocurrency assets and said an alleged Russian organizer has been identified, with foreign partners suggesting possible links to the **Conti** ransomware ecosystem. A third item—a *Citizen Lab* job posting—does not report a specific incident and is primarily recruitment content, despite referencing prior research on targeted phishing and spyware threats.
Jul 2, 2026
German authorities charged four people over the alleged sale of **FinFisher/FinSpy** surveillance software to Turkey without the export license required for dual-use spyware. The case grew out of a Munich prosecutors' investigation into whether the German spyware maker exported the tool illegally, after journalists and rights groups alleged that FinSpy had been delivered to Turkey despite Germany saying no export permits for such spyware had been issued since 2015. The allegations stem from a 2017 campaign in which anti-government protesters in Turkey were reportedly targeted through fake Twitter accounts and malicious smartphone apps linked to **FinSpy**. Researchers and complainants said the spyware could give operators extensive access to victims' communications and device data, and organizations including Reporters Without Borders, Netzpolitik.org, GFF, and the European Center for Constitutional and Human Rights pushed for the investigation that ultimately led to charges.
Jul 12, 2026
Citizen Lab reported that Hacking Team’s **Remote Control System (RCS)**, a commercial spyware platform marketed as “untraceable” and sold to governments, could be mapped through analysis of its proxy-chain infrastructure. The research linked suspected current or former RCS use to 21 governments, including **Azerbaijan, Egypt, Ethiopia, Italy, Mexico, Morocco, Saudi Arabia, Sudan, Turkey, the UAE, and Uzbekistan**, and showed how traffic passed through intermediary servers before reaching government-operated endpoints. The report also tied exploit-laden documents and shared staging behavior to a likely common commercial exploit supplier, while documenting attacks against dissidents, journalists, and activists such as **Mamfakinch** in Morocco, **Ahmed Mansoor** in the UAE, and Ethiopian journalists in Washington, DC. Separate technical analysis presented by ESET found that Hacking Team’s spyware development continued after the company’s 2015 breach, with post-leak **RCS** samples compiled between 2015 and 2017 observed in 14 countries. Researchers said the malware preserved Hacking Team’s two-stage **Scout** and **Soldier/Elite** architecture and surveillance functions including screenshot capture, password theft, keylogging, camera activation, Skype call recording, and Wi-Fi-based geolocation. Attribution to Hacking Team developers was supported by code continuity, compilation patterns, versioning, and a chain of six signing certificates, including certificates linked to co-founder **Valeriano Bedeschi**, indicating the company’s spyware ecosystem remained active despite public exposure and source-code leakage.
Aug 15, 2026