Malwarecritical
Mercenary mayhem: A technical analysis of Intellexa's PREDATOR spyware
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-1048 | Use-After-Free Privilege Escalation in Android Kernel (CVE-2021-1048) | 7.8 | 1% | KEV | KEV |
| CVE-2021-37973 | Use-After-Free Sandbox Escape in Google Chrome/Chromium Portals | 9.6 | 12% | KEV | KEV |
| CVE-2021-37976 | Information Disclosure in Google Chrome/Chromium Memory Implementation (CVE-2021-37976) | 6.5 | 20% | KEVPoC | KEV |
| CVE-2021-38000 | Improper Input Validation in Google Chrome for Android Allows Forced URL Navigation | 6.1 | 5% | KEVPoC | KEV |
| CVE-2021-38003 | Memory Corruption in Chromium V8 JSON.stringify Affects Chrome, Edge, Opera | 8.8 | 39% | KEVPoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | fs.db | red[.]so PREDATOR spyware shared library /data/local/tmp/wd/fs[.]db SQLITE3 file containing additional payloads ALIEN is not |
| domain | pred.so | e files can be found on it. Path Purpose /data/local/tmp/wd/pred[.]so PREDATOR spyware shared library /data/local/tmp/wd/fs[.]d |
From the original article
13 min read at blog.talosintelligence.com
We would like to thank The Citizen Lab for their cooperation, support and inputs into this research. Commercial spyware use is on the rise, with actors leveraging these sophisticated tools to conduct surveillance operations against a growing number of targets. Cisco Talos has new details of a commercial spyware product sold by the spyware firm Intellexa (formerly known as Cytrox).
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.