Predator Spyware Linked to Madagascar’s Government Ahead of Election
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-41993 | WebKit Code Execution Flaw in Apple iOS, iPadOS, macOS, and Safari Apple's WebKit engine, which renders web content for Safari and for essentially all HTML processing on iOS, iPadOS, and macOS, contains a flaw that leads to code execution when processing maliciously crafted web content. It is triggered when a user's browser or embedded web view loads attacker-controlled web content, so simply visiting a hostile page can be enough. Successful exploitation could allow arbitrary code execution within the affected application's context, a common stepping stone to broader device compromise. All users of Apple iOS, iPadOS, macOS, and Safari are potentially affected, as are users of non-Apple products that rely on WebKit for HTML processing. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2023-09-25, indicating confirmed in-the-wild exploitation; no public proof-of-concept is known. Do: Apply Apple's latest security updates for iOS, iPadOS, macOS, and Safari that patch WebKit, following the vendor instructions referenced by the CISA KEV entry, and treat unpatched WebKit builds as actively exploited. Until systems are patched, restrict exposure to untrusted web content (e.g., limit browsing and in-app web views to trusted sites for high-risk users). Also inventory any non-Apple applications or HTML-processing components in your environment that bundle WebKit and update them as their maintainers ship fixes. | 8.8 group max | 29% | KEV |
| mass1+ billion devices/users (WebKit ships in Safari and all web-content rendering on iOS, iPadOS, and macOS) |
Full article481 words · extracted from infosecurity-magazine.com · click to collapse
The Madagascar government likely used the Cytrox-developed Predator spyware to conduct political domestic surveillance ahead of the country’s presidential election, according to research by Sekoia.
French threat intelligence firm Sekoia’s latest technical analysis of Cytrox’s infrastructure was prompted by recent revelations that Predator had been installed on the iPhone of the former Egyptian MP Ahmed Eltantawy.
Citizen Lab, a tech research laboratory based at the University of Toronto, found that in August and September 2023, Eltantawy was targeted via network-based injection, redirecting him to malicious web pages when he visited non-HTTPS sites by exploiting a zero-day exploit chain (CVE-2023-41991, CVE-2023-41992, CVE-2023-41993) used to install Predator on iOS versions up to 16.6.1.
Cytrox is a subsidiary of Intellexa, an Israeli-founded, Greece-based surveillance company responsible for developing several spyware tools, including Predator.
Sekoia found a list of virtual private servers (VPS) linked with fake URL shorteners or malicious websites, including typosquatting news websites. These websites are likely used as entry points for exploit kits.
“At the end, 121 unique active domain names were found being related with high confidence to an infrastructure cluster linked to the Lycantrox intrusion set,” reads the report. Lycantrox is the name given by Sekoia when tracking Cytrox infrastructure.
Some domain names were linked with Madagascar-based websites, including WordPress blogs containing real articles taken from the Malagasy newspaper Midi Madagasikara.
Based on these findings and the alleged existence of a contract between Intellexa and Madagascar’s government for the collection and processing of interception data, previously reported by Intelligence Online, Sekoia assessed it is “plausible Madagascar government services – such as police or domestic intelligence – did purchase and leverage Cytrox’s Predator malware to conduct political domestic surveillance, months before the election.”
Read more: Why Zero Days Are Set for Highest Year on Record
Which Governments Are Linked to Predator Spyware?
In the report, Sekoia also found domain names linked with a typosquatted IP address of Jubi TV, an Indonesian opposition media in West Papua province, and Angolan media websites. The firm estimated that it was “possible” that the regimes of these two countries used Predator spyware.
Other domain names found by Sekoia researchers were located in Egypt, Portugal, Kazakhstan and the Persian Gulf.
The firm believes that these novel, previously unheard-of findings about the use of Predator could be attributed to Cytrox having recently hardened its reverse proxies.
“Sometimes, too much hardening can be discriminatory from a defender point of view, as we can see with this correlation,” the researchers wrote.
Mobile users who want to check the presence of domain names leveraged by Cytrox to deploy Predator can download the ‘MVT for analysis’ or ‘Spyguard’ apps.
Read more: NSO Group's Recent Difficulties Could Shape the Future of the Spyware Industry
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/predator-spyware-madagascar/