article thumbnail

Experts link Hermit spyware to Italian surveillance firm RCS Lab and a front company

Security Affairs

Experts uncovered an enterprise-grade surveillance malware dubbed Hermit used to target individuals in Kazakhstan, Syria, and Italy since 2019. Lookout Threat Lab researchers uncovered enterprise-grade Android surveillance spyware, named Hermit, used by the government of Kazakhstan to track individuals within the country.

Spyware 81
article thumbnail

Google TAG argues surveillance firm RCS Labs was helped by ISPs to infect mobile users

Security Affairs

Google’s Threat Analysis Group (TAG) revealed that the Italian spyware vendor RCS Labs was supported by ISPs to spy on users. TAG researchers tracked more than 30 vendors selling exploits or surveillance capabilities to nation-state actors. Follow me on Twitter: @securityaffairs and Facebook. Pierluigi Paganini.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Syria-linked APT group SEA targets Android users with COVID19 lures

Security Affairs

Syrian-linked APT group SEA recently used COVID-19-themed lures as part of a long-running surveillance campaign, security researchers warn. The experts found 71 malicious Android applications that were connecting to the same C2 server having an IP address linked to the Syrian Telecommunications Establishment (STE).

article thumbnail

Security Affairs newsletter Round 438 by Pierluigi Paganini – International edition

Security Affairs

0-days exploited by commercial surveillance vendor in Egypt PREDATOR IN THE WIRES OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes Cybersecurity Apple and Google Are Introducing New Ways to Defeat Cell Site Simulators, But Is it Enough?

article thumbnail

The Belgacom hack was the work of the UK GCHQ intelligence agency

Security Affairs

Back to September 2013, Belgacom (now Proximus), the largest telecommunications company in Belgium and primarily state-owned, announced its IT infrastructure had suffered a malware-based attack. Specifically, these are IP addresses of computers where the spyware software communicated from Belgacom. ” wrote The Intercept.

Hacking 83
article thumbnail

Weakness at the Network Edge: Mandiant Examines 2022’s Zero-Day Exploits

eSecurity Planet

” The three activity sets included a campaign against the Philippine government between March and May 2022; a campaign against telecommunications and business service providers in South Asia in April 2022; and a campaign against organizations in Belarus and Russia in May 2022.

article thumbnail

APT trends report Q1 2021

SecureList

During routine monitoring of detections for FinFisher spyware tools, we discovered traces that point to recent FinFly Web deployments. The victims we observed were all high-profile Tunisian organizations, such as telecommunications or aviation companies. Domestic Kitten is a threat group mainly known for its mobile backdoors.

Malware 139