Hackers used spyware made in Spain to target users in the UAE, Google says
Reading Time: 2 minutesIn November 2022, Google revealed the existence of a then-unknown spyware vendor called Variston. Now, Google researchers say they have seen hackers use Variston’s tools in the United Arab Emirates.
In a report published on Wednesday, Google’s Threat Analysis Group (TAG) said it discovered hackers targeting people in the UAE who used Samsung’s native Android browser, which is a customized version of Chromium. The hackers used a set of vulnerabilities chained together and delivered via one-time web links sent to the targets by text message. Of the four vulnerabilities in the chain, two were zero-days at the time of the attack, meaning they had not been reported to the software maker and were unknown at that point, according to the new blog post by TAG.
‘The actor using the exploit chain to target UAE users may be a customer or partner of Variston, or otherwise working closely with the spyware vendor,’ the blog post read.
Samsung did not respond to a request for comment.
Ralf Wegener and Ramanan Jayaraman are the founders of Variston, according to Intelligence Online, an online news publication that covers the surveillance industry. Neither founder responded to a request for comment. Variston is headquartered in Barcelona, Spain. According to business registration records in Italy, Variston acquired the Italian zero-day research company Truel in 2018.
Google also said on Wednesday that it discovered hackers exploiting an iOS zero-day bug, patched in November, to remotely plant spyware on users’ devices. The researchers say they observed attackers abusing the security flaw as part of an exploit chain targeting iPhone owners running iOS 15.1 and older located in Italy, Malaysia and Kazakhstan.
The flaw was found in the WebKit browser engine that powers Safari and other apps, and was first discovered and reported by Google TAG researchers. Apple patched the bug in December, confirming at the time that the company was aware that the vulnerability was actively exploited ‘against versions of iOS released before iOS 15.1.’
Hackers also used a second iOS vulnerability described as a PAC bypass technique that was fixed by Apple in March 2022, which Google researchers say is the exact technique used by North Macedonian spyware developer Cytrox to install its Predator spyware. Citizen Lab previously released a report highlighting widespread government use of the Predator spyware.
Google also observed hackers exploiting a chain of three Android bugs targeting devices running an ARM-based graphics chip, including one zero-day. Google said ARM released a fix, but several vendors — including Samsung, Xiaomi, Oppo, and Google itself — did not incorporate the patch, resulting in ‘a situation where attackers were able to freely exploit the bug for several months,’ Google said.
The discovery of these new hacking campaigns is ‘a reminder that the commercial spyware industry continues to thrive, says Google. ‘Even smaller surveillance vendors have access to 0-days, and vendors stockpiling and using 0-day vulnerabilities in secret poses a severe risk to the Internet.’
‘These campaigns may also indicate that exploits and techniques are being shared between surveillance vendors, enabling the proliferation of dangerous hacking tools,’ the blog read.
Reference: https://techcrunch.com/2023/03/29/hackers-variston-spyware-uae-google/
Ref: techcrunch
MediaDownloader.net -> Free Online Video Downloader, Download Any Video From YouTube, VK, Vimeo, Twitter, Twitch, Tumblr, Tiktok, Telegram, TED, Streamable, Soundcloud, Snapchat, Share, Rumble, Reddit, PuhuTV, Pinterest, Periscope, Ok.ru, MxTakatak, Mixcloud, Mashable, LinkedIn, Likee, Kwai, Izlesene, Instagram, Imgur, IMDB, Ifunny, Gaana, Flickr, Febspot, Facebook, ESPN, Douyin, Dailymotion, Buzzfeed, BluTV, Blogger, Bitchute, Bilibili, Bandcamp, Akıllı, 9GAG