LANDFALL: New Commercial-Grade Android Spyware in Exploit Chain Targeting Samsung Devices
Summary: Unit 42 researchers discovered a previously unknown Android spyware family they named LANDFALL, delivered by exploiting CVE-2025-21042, a zero-day in Samsung's image-processing library libimagecodec.quram.so that Samsung patched in April 2025, with the spyware embedded in malformed DNG image files that appear to have been sent via WhatsApp and that were uploaded to VirusTotal throughout 2024 and early 2025. The campaign was already operating in mid-2024, months before the vulnerability was fixed, and VirusTotal submission data points to potential targets in Iraq, Iran, Turkey and Morocco.
Key Takeaway: A commercial-grade espionage tool built on a Samsung zero-day ran undetected for months before the patch, and Unit 42 could not attribute it to a known private sector offensive actor or threat actor - meaning the organization behind it remains unidentified.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2025-21042CVE-2025-21043CVE-2025-43300CVE-2025-55177
- Related