Mercenary mayhem: A technical analysis of Intellexa's PREDATOR spyware
Summary: Cisco Talos analyzed Intellexa's PREDATOR spyware, which has existed since at least 2019 and is deployed via a one-click exploit chain, and found it works in tandem with a second component called ALIEN rather than ALIEN serving merely as a loader. The Android samples use the QUAILEGGS privilege-escalation method, which Talos assesses likely exploits CVE-2021-1048, and can record audio from phone and VOIP calls and collect data from Signal, WhatsApp and Telegram.
Key Takeaway: CVE-2021-1048 was public since August 2020 and patched in September, yet some Google Pixel phones stayed vulnerable until March 2021 and Samsung devices until at least October 2021 - a window measured in months during which this spyware could escalate to SYSTEM level.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2021-1048CVE-2021-37973CVE-2021-37976CVE-2021-38000CVE-2021-38003
- Related
- CVE-2021-1048: Android Kernel Use-After-Free Vulnerability Known Exploited Vulnerabilities · May 23, 2022CVE-2021-38003: Google Chromium V8 Memory Corruption Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021CVE-2021-38000: Google Chromium Intents Improper Input Validation Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021