RedEyes Group Wiretapping Individuals (APT37) - ASEC BLOG – June 2023

RedEyes (also known as APT37, ScarCruft, and Reaper) is a state\-sponsored APT group that mainly carries out attacks against individuals such as North Korean defectors, human rights activists, and university professors. Their task is known to be monitoring the lives of specific individuals. In May 2023, AhnLab Security Emergency response Center (ASEC) discovered the RedEyes group distributing and using an Infostealer with wiretapping features that was previously unknown along with a backdoor developed using GoLang that exploits the Ably platform.

#Korea #APT #RedEyes #APT37 #StarCruft #Reaper

Dissecting TriangleDB, a Triangulation spyware implant | Securelist – June 2023

Over the years, there have been multiple cases when iOS devices were infected with targeted spyware such as Pegasus, Predator, Reign and others. Often, the process of infecting a device involves launching a chain of different exploits, e.g. for escaping the iMessage sandbox while processing a malicious attachment, and for getting root privileges through a vulnerability in the kernel. Due to this granularity, discovering one exploit in the chain often does not result in retrieving the rest of the chain and obtaining the final spyware payload.In 2021, analysis of iTunes backups helped to discover an attachment containing the FORCEDENTRY exploit. However, during post\-exploitation, the malicious code downloaded a payload from a remote server that was not accessible at the time of analysis. Consequently, the analysts lost “the ability to follow the exploit.”

#FORCEDENTRY #Ios #TriangleDB #spyware

Thai Activists Sue Government Over Alleged Use of Pegasus Spyware – The Diplomat – June 2023

`Two prominent Thai activists have launched legal action accusing Prime Minister Prayut Chan-o-cha’s government of using Pegasus spyware to infiltrate their mobile devices during a campaign of anti-government demonstrations in late 2020 and early 2021.

According to The Associated Press, human rights lawyer Arnon Nampa and legal reform advocate Yingcheep Atchanont filed a lawsuit yesterday accusing nine state agencies of unlawfully violating their privacy by using the spyware app, which is produced by the Israeli cybersecurity company NSO Group. Among those are the Office of the Prime Minister, the Royal Thai Police, the Ministry of Digital Economy and Society, and the three branches of the armed forces.`

#Thailand #Pegasus #NSO

Watergate grec : la commission PEGA en colère après avoir reçu une « lettre d’avertissement » – EURACTIV – 2023

`Des membres de la commission du Parlement européen chargée d’enquêter sur l’utilisation des logiciels espions de surveillance (PEGA) sont en colère après avoir reçu une « lettre d’avertissement » de la société Intellexa, qui pourrait être à l’origine de la vente du logiciel Predator.

Le logiciel Predator aurait été utilisé par les services secrets grecs pour surveiller des journalistes et des opposants politiques au gouvernement conservateur Nouvelle Démocratie (Néa Dimokratía, ND).

La commission PEGA, qui a été créée pour enquêter sur l’utilisation de Pegasus et de logiciels espions de surveillance équivalents, a récemment conclu dans un rapport que les sociétés Intellexa basées en Grèce avaient exporté leurs produits — notamment le logiciel Predator — vers le Bangladesh, le Soudan, Madagascar et au moins un pays arabe.`

#PEGA #Predator #UE #Pegasus #LogicielEspion #Grèce #Intellexa

The PEGA Committee of Inquiry into the use of spyware published its final recommendations on May 22, 2023.

`This committee of the European Parliament was tasked with investigating the violations committed by spyware within the European Union.

In the aftermath of the Pegasus scandal, the ECCP has advocated to the PEGA Committee on the three following points:

That spyware technology is dangerous and that the commercial exchange of vulnerabilities gives unstoppable power in the hands of any who buys the technology. Even law enforcement agencies can use spyware without accountability and exceed limitations set by court orders on surveillance without leaving a trace.

That Israeli spyware companies sell a product which was tested on Palestinians in the course of the Israeli occupation, apartheid policies and the oppression of civil society organizations. False accusations of terrorism were justified by “evidence” collected by spyware among other means, which turned out to be falsified.`
#Pegasus #PEGA #EU

Sweet QuaDreams: A First Look at Spyware Vendor QuaDream’s Exploits, Victims, and Customers - The Citizen Lab – 2023

`Based on an analysis of samples shared with us by Microsoft Threat Intelligence, we developed indicators that enabled us to identify at least five civil society victims of QuaDream’s spyware and exploits in North America, Central Asia, Southeast Asia, Europe, and the Middle East. Victims include journalists, political opposition figures, and an NGO worker. We are not naming the victims at this time.
We also identify traces of a suspected iOS 14 zero-click exploit used to deploy QuaDream’s spyware.

The exploit was deployed as a zero-day against iOS versions 14.4 and 14.4.2, and possibly other versions. The suspected exploit, which we call ENDOFDAYS, appears to make use of invisible iCloud calendar invitations sent from the spyware’s operator to victims.`
#Quadream #spyware #ENFOFDAYS #Ios #Calendar #Icloud

Pire que Pegasus : voici Toka, la plus dangereuse société israélienne de logiciels espions dont vous ayez jamais entendu parler – Mint Press - 2021 - Whitney Webb

`Toka a été lancé en 2018 dans le but explicite de vendre un « écosystème sur mesure de cybercapacités et de produits logiciels pour les agences gouvernementales, d'application de la loi et de sécurité ». Selon un profil de la société publié dans Forbes peu de temps après son lancement, Toka s'est présentée comme "un guichet unique de piratage pour les gouvernements qui ont besoin de capacités supplémentaires pour lutter contre les terroristes et d'autres menaces à la sécurité nationale dans le domaine numérique".

Toka a lancé son projet de "fournir des outils d'espionnage pour tous les appareils dont ses clients ont besoin", y compris non seulement les smartphones`, mais un "accent particulier sur le soi-disant Internet des objets (IoT)".

#Toka #LogicielEspion #Israel
#IOT #Pegasus

Meet Toka, the Most Dangerous Israeli Spyware Firm You've Never Heard Of – Mint Press - 2021 - Whitney Webb

`Toka was launched in 2018 with the explicit purpose of selling a “tailored ecosystem of cyber capabilities and software products for governmental, law enforcement, and security agencies.” According to a profile of the company published in Forbes shortly after it launched, Toka advertised itself as “a one-stop hacking shop for governments that require extra capability to fight terrorists and other threats to national security in the digital domain.”

Toka launched with plans to “provide spy tools for whatever device its clients require,” including not only smartphones but a[“special focus on the so\-called Internet of Things (IoT)](https://www.haaretz.com/israel\-news/security\-aviation/2022\-12\-26/ty\-article\-magazine/.premium/this\-dystopian\-cyber\-firm\-could\-have\-saved\-mossad\-assassins\-from\-exposure/00000185\-0bc6\-d26d\-a1b7\-dbd739100000).” Per the company, this includes devices like Amazon Echo, Google Nest-connected home products, as well as connected fridges, thermostats and alarms. Exploits in these products discovered by Toka.`#Toka #IOT #Spyware #Israel
#Pegasus

Comment fonctionne le logiciel espion Pegasus ? - Le Monde Informatique – 2021

En fouillant un peu plus, les chercheurs ont trouvé au sein d’une des 2 bases de données SQLite (en l’occurrence DataUsage.sqlite) présentes dans iOS l’enregistrement d’un processus suspect nommé « bh ». En croisant les travaux menés par Lookout, ils pensent que « bh » fait référence à BridgeHead, nom d’un module de Pegasus chez NSO Group . Ce composant a pour mission de préparer le terrain (navigateur, modifier la configuration du terminal,…) à l’installation de Pegasus.

#NSO #Pegasus #Lookout