Forest Global Training Partners

Cyber Risks · Cisco Talos

The growth of commercial spyware based intelligence providers without legal or ethical supervision

Summary: Commercial spyware vendors use zero- or one-click zero-day exploits to compromise mobile devices, a threat that surfaced with the 2015 HackingTeam leaks and expanded after reporting on NSO Group to include firms such as Intellexa, DSIRF, Variston IT and Quadream. Cisco Talos reports these companies often base themselves in countries without export laws or that classify them as IT service providers, and that some rebrand or merge when exposed, as Cytrox did by joining Intellexa.

Bottom line: The targets have repeatedly been journalists, politicians and activists rather than criminals, and in Greece a Predator infection of a journalist led to the 2022 resignation of the National Intelligence Service director and a national ban on commercial spyware. Talos notes some vendors are confident enough to skip persistence entirely, since a reboot clears the implant and they simply reinfect using the same zero-day and zero-click combination.

Read the original at Cisco Talos ↗

Topics
Malware
Related