Pegasus

In February 2024, R3D reported that the Cyberspace Operations Center under the Secretariat of National Defense had used HIWIRE monitoring software from Israeli firm WebintPro to identify links between social media users critical of the Mexican Armed Forces or the government as recently as May 2022.

Further investigations by Amnesty International revealed that the domain link in the message belongs to a large infrastructure of more than 600 malicious domains, some of which had been previously connected to NSO Group.

...text messages... luring them to click on links that secretly unlock a target’s smartphone and turn it into a powerful surveillance device.

The messages that were sent to Ms. Aristegui — which included a link to click on that would then install the spyware — especially interested me. As I reviewed them, I began to panic. I’d received identical messages, I recalled, and I remembered clicking on one of them.

From a technical perspective, such spyware campaigns often rely on zero-click exploits, baseband vulnerabilities, or malicious configuration profiles to gain persistent access to mobile systems.

One message, sent to one of the investigators in March, was from someone posing as a close friend whose father had died. A link was attached with the details of the funeral. When the link was opened, the website of a well-known funeral home in Mexico popped up.

From a technical perspective, such spyware campaigns often rely on zero-click exploits, baseband vulnerabilities, or malicious configuration profiles to gain persistent access to mobile systems.

The Citizen Lab reported “a growing ecosystem of spyware capability” among Ontario police services, after identifying server infrastructure that indicated potential use of Paragon Solutions’ Graphite spyware by the Ontario Provincial Police.

The biggest distinction between the iOS and Android versions of Pegasus is the Android version does not use zero-day vulnerabilities to root the device... Instead, the threat uses an otherwise well-known rooting technique called Framaroot. | The Android version of one of the most sophisticated and targeted mobile attacks we’ve seen in the wild: Pegasus... developed the Pegasus malware, which jailbreaks or roots target devices to surveil specific targets.

Additionally, we identified a new previously unknown domain: hmizat[.]co, which seems to impersonate Hmizate, an e-commerce company from Morocco.

The Citizen Lab reported “a growing ecosystem of spyware capability” among Ontario police services, after identifying server infrastructure that indicated potential use of Paragon Solutions’ Graphite spyware by the Ontario Provincial Police.

From a technical perspective, such spyware campaigns often rely on zero-click exploits, baseband vulnerabilities, or malicious configuration profiles to gain persistent access to mobile systems.

ФСБ России объявила об обнаружении масштабной операции иностранных спецслужб, которые использовали вредоносное ПО для слежки за российскими высокопоставленными служащими через мобильные устройства.

Once deployed, the spyware can access encrypted messaging apps, capture keystrokes, activate microphones and cameras, and exfiltrate stored files.

We believe this is a symptom of a network injection attack generally called “man-in-the-middle” attack. Through this, an attacker with privileged access to a target’s network connection can monitor and opportunistically hijack traffic, such as web requests.

From a technical perspective, such spyware campaigns often rely on zero-click exploits, baseband vulnerabilities, or malicious configuration profiles to gain persistent access to mobile systems.

атакующие могли получать данные со смартфонов

ФСБ России объявила об обнаружении масштабной операции иностранных спецслужб, которые использовали вредоносное ПО для слежки за российскими высокопоставленными служащими через мобильные устройства.

Once deployed, the spyware can access encrypted messaging apps, capture keystrokes, activate microphones and cameras, and exfiltrate stored files.

Pegasus, uses malicious links in misleading text messages to infiltrate cellphones to monitor emails, contacts and text messages.

прослушивать переговоры, а также вести скрытое аудио

вести скрытое аудио- и видеонаблюдение рядом с устройствами

The operation involved the implantation and activation of malicious software capable of extracting sensitive data, intercepting communications, and conducting unauthorized audio and video recordings.

We believe this is a symptom of a network injection attack generally called “man-in-the-middle” attack. Through this, an attacker with privileged access to a target’s network connection can monitor and opportunistically hijack traffic, such as web requests.

The agency stated that the campaign was orchestrated by unidentified foreign intelligence services and aimed at covert surveillance and data exfiltration.