Predator: Looking under the hood of Intellexa’s Android spyware

[MuzzMelbourne]

Content source

https://www.bleepingcomputer.com/news/security/predator-looking-under-the-hood-of-intellexas-android-spyware/

Security researchers at Cisco Talos and the Citizen Lab have presented a new technical analysis of the commercial Android spyware 'Predator' and its loader 'Alien,' sharing its data-theft capabilities and other operational details.

Predator is a commercial spyware for mobile platforms (iOS and Android) developed and sold by Israeli company Intellexa.

The spyware family has been linked to surveillance operations targeting journalists, high-profile European politicians, and even Meta executives.

The spyware can record phone calls, collect information from messaging apps, or even hide applications and prevent their execution on infected Android devices.

Predator: Looking under the hood of Intellexa’s Android spyware

Security researchers at Cisco Talos and the Citizen Lab have presented a new technical analysis of the commercial Android spyware 'Predator' and its loader 'Alien,' sharing its data-theft capabilities and other operational details.

www.bleepingcomputer.com

 

[Jonny Quest]

"The spyware can record phone calls, collect information from messaging apps, or even hide applications and prevent their execution on infected Android devices".
Okay, how did this get installed, and from the below link, I didn't see where it was a downloaded app that installed the Predator spyware or through an Android update, a download link, spyware implants...what are those?
How does, did that happen, @Trident any ideas?

Google: Predator spyware infected Android devices using zero-days

Google's Threat Analysis Group (TAG) says that state-backed threat actors used five zero-day vulnerabilities to install Predator spyware developed by commercial surveillance developer Cytrox.

www.bleepingcomputer.com

Google's Threat Analysis Group (TAG) says that state-backed threat actors used five zero-day vulnerabilities to install Predator spyware developed by commercial surveillance developer Cytrox.

In these attacks, part of three campaigns that started between August and October 2021, the attackers used zero-day exploits targeting Chrome and the Android OS to install Predator spyware implants on fully up-to-date Android devices.

 

[Trident]

@Jonny Quest from the link it looks like links were sent by email. Once clicked, the domain/web page exploited 5 zero-day vulnerabilities (that’s quite unusual and impressive as an attack which suggests the attackers were well funded). Through the exploit the Alien loader was delivered which further downloaded necessary components for the spyware and kept them hidden within system processes.

This is a highly commercial spyware similar to the Mercenary that targeted Apple users like journalists and other people of interest.

Mercenary mayhem: A technical analysis of Intellexa's PREDATOR spyware

Commercial spyware use is on the rise, with actors leveraging these sophisticated tools to conduct surveillance operations against a growing number of targets. Cisco Talos has new details of a commercial spyware product sold by the spyware firm Intellexa (formerly known as Cytrox).

blog.talosintelligence.com

 

[Jonny Quest]

@Jonny Quest from the link it looks like links were sent by email. Once clicked, the domain/web page exploited 5 zero-day vulnerabilities (that’s quite unusual and impressive as an attack which suggests the attackers were well funded). Through the exploit the Alien loader was delivered which further downloaded necessary components for the spyware and kept them hidden within system processes.

This is a highly commercial spyware similar to the Mercenary that targeted Apple users like journalists and other people of interest.

Mercenary mayhem: A technical analysis of Intellexa's PREDATOR spyware

Commercial spyware use is on the rise, with actors leveraging these sophisticated tools to conduct surveillance operations against a growing number of targets. Cisco Talos has new details of a commercial spyware product sold by the spyware firm Intellexa (formerly known as Cytrox).

blog.talosintelligence.com

Thank you, buddy, for taking the time to hunt that down and for looking into it for me, as I really didn't catch how it was installed. But I thought the same thing, pretty impressive exploit.

 

[Trident]

Thank you, buddy, for taking the time to hunt that down and for looking into it for me, as I really didn't catch how it was installed. But I thought the same thing, pretty impressive exploit.

These spyware products are on sale for high prices, advertised as tools for “surveillance against criminals and terrorists” by organisations as NSO. It’s not their first product and it definitely won’t be the last. In the past few years, the ethics and purpose of their spyware have been questions not once or twice.

Britain sounds alarm on spyware, mercenary hacking market

British officials are sounding the alarm over the widespread abuse of surveillance software and hackers-for-hire, saying that thousands of people were being targeted each year by an industry they described as posing an increasingly unpredictable threat.

www.reuters.com

NSO Group returns with triple iOS 15/16 zero-click spyware attack

The NSO Group hasn’t gone away; the privatized spying service was active in 2022 with zero-click exploits against iOS 15 and iOS 16, according to Citizen Lab.

www.computerworld.com

It further demonstrates that if you employ the right people and give them the right incentive, nothing is too secure.

 

[Socalvisit]

@Jonny Quest from the link it looks like links were sent by email. Once clicked, the domain/web page exploited 5 zero-day vulnerabilities (that’s quite unusual and impressive as an attack which suggests the attackers were well funded). Through the exploit the Alien loader was delivered which further downloaded necessary components for the spyware and kept them hidden within system processes.

This is a highly commercial spyware similar to the Mercenary that targeted Apple users like journalists and other people of interest.

Mercenary mayhem: A technical analysis of Intellexa's PREDATOR spyware

Commercial spyware use is on the rise, with actors leveraging these sophisticated tools to conduct surveillance operations against a growing number of targets. Cisco Talos has new details of a commercial spyware product sold by the spyware firm Intellexa (formerly known as Cytrox).

blog.talosintelligence.com

It is a good Read!

 

[vtqhtr413]

On the Trail of the Predator: North Macedonia, Greece and Germany​

One message, one link, one click. That's all it takes to lose control of your digital life, unwittingly and in a matter of seconds. Greek reporter Thanasis Koukakis has experienced it. The message sounded innocuous enough, like one of the many tips journalists are regularly sent. "Thanasis, have you heard about this?" When he clicked on the link in summer 2021, a small program installed itself imperceptibly on his phone. It opened the door to the spyware program Predator, a virtual beast of prey.

Suddenly, Koukakis was completely exposed, and remained so for 10 weeks. The software allowed the attackers to see where the reporter was moving, who he was talking to, who he was sending which messages to and what he was researching. Koukakis has spent years reporting on corruption, keeping a close eye on the powerful in Greece, and his work has appeared on the satellite news station CNN and in the Financial Times. Now, though, his informants were in danger of being exposed.

The Predator Files: European Spyware Consortium Supplied Despots and Dictators

The Intellexa Alliance is the name of the shady group of European companies that supplies dictators and despots with cyberweapons. The mass spyware attacks have also been lucrative for some in Germany.

www.spiegel.de