Russian government hackers found using exploits made by spyware companies NSO and Intellexa
Reading Time: 3 minutesGoogle says it has evidence that Russian government hackers are using exploits that are ‘identical or strikingly similar’ to those previously made by spyware makers Intellexa and NSO Group.
In a blog post on Thursday, Google said it is not sure how the Russian government acquired the exploits, but said this is an example of how exploits developed by spyware makers can end up in the hands of ‘dangerous threat actors.’
In this case, Google says the threat actors are APT29, a group of hackers widely attributed to Russia’s Foreign Intelligence Service, or the SVR. APT29 is a highly capable group of hackers, known for its long-running and persistent campaigns aimed at conducting espionage and data theft against a range of targets, including tech giants Microsoft and SolarWinds, as well as foreign governments.
Google said it found the hidden exploit code embedded on Mongolian government websites between November 2023 and July 2024. During this time, anyone who visited these sites using an iPhone or Android device could have had their phone hacked and data stolen, including passwords, in what is known as a ‘watering hole’ attack.
The exploits took advantage of vulnerabilities in the iPhone’s Safari browser and Google Chrome on Android that had already been fixed at the time of the suspected Russian campaign. Still, those exploits nevertheless could be effective in compromising unpatched devices.
According to the blog post, the exploit targeting iPhones and iPads was designed to steal user account cookies stored in Safari specifically across a range of online email providers that host the personal and work accounts of the Mongolian government. The attackers could use the stolen cookies to then access those government accounts. Google said the campaign aimed at targeting Android devices used two separate exploits together to steal user cookies stored in the Chrome browser.
Lecigne, who works for Google’s Threat Analysis Group, the security research unit that investigates government-backed cyber threats, said Google is linking the reuse of the code to Russia because the researchers previously observed the same cookie-stealing code used by APT29 during an earlier campaign in 2021.
A key question remains: How did the Russian government hackers obtain the exploit code to begin with? Google said both iterations of the watering hole campaign targeting the Mongolian government used code resembling or matching exploits from Intellexa and NSO Group. These two companies are known for developing exploits capable of delivering spyware that can compromise fully-patched iPhones and Android phones.
Google said the exploit code used in the watering hole attack targeting Chrome users on Android shared a ‘very similar trigger’ with an exploit developed earlier by NSO Group. In the case of the exploit targeting iPhones and iPads, Google said the code used the ‘exact same trigger as the exploit used by Intellexa,’ which Google said strongly suggested that the exploit authors or providers ‘are the same.’
‘There are multiple possibilities as to how they could have acquired the same exploit, including purchasing it after it was patched or stealing a copy of the exploit from another customer,’ said Lecigne.
Google said users should ‘apply patches quickly’ and keep software up-to-date to help prevent malicious cyberattacks. According to Lecigne, iPhone and iPad users with the high-security feature Lockdown Mode switched on were not affected even when running a vulnerable software version.
Ref: techcrunch
MediaDownloader.net -> Free Online Video Downloader, Download Any Video From YouTube, VK, Vimeo, Twitter, Twitch, Tumblr, Tiktok, Telegram, TED, Streamable, Soundcloud, Snapchat, Share, Rumble, Reddit, PuhuTV, Pinterest, Periscope, Ok.ru, MxTakatak, Mixcloud, Mashable, LinkedIn, Likee, Kwai, Izlesene, Instagram, Imgur, IMDB, Ifunny, Gaana, Flickr, Febspot, Facebook, ESPN, Douyin, Dailymotion, Buzzfeed, BluTV, Blogger, Bitchute, Bilibili, Bandcamp, Akıllı, 9GAG