Campaigns abusing corporate trusted infrastructure hunt for corporate credentials on ICS networks

In 2021, Kaspersky ICS CERT experts noticed a growing number of anomalous spyware attacks infecting ICS computers across the globe. Although the malware used in these attacks belongs to well-known commodity spyware families, these attacks stand out from the mainstream Read More …

After NSO Scandal, What’s Next for Israel’s Cyber Industry?

The year 2021 was not a good one for NSO Group, an Israeli technology firm that became famous, and then notorious, for its Pegasus spyware, capable of remote surveillance of smartphones. Once a promising startup that developed a unique tool Read More …

A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

Google Project Zero researchers want to thank Citizen Lab for sharing a sample of the FORCEDENTRY exploit with them, and Apple’s Security Engineering and Architecture (SEAR) group for collaborating with Google Project Zero on the technical analysis. The editorial opinions Read More …

PseudoManuscrypt: a mass-scale spyware attack campaign

In June 2021, Kaspersky ICS CERT experts identified malware whose loader has some similarities to the Manuscrypt malware, which is part of the Lazarus APT group’s arsenal. In 2020, the group used Manuscrypt in attacks on defense enterprises in different Read More …

US lawmakers want to put NSO Group, 3 other spyware makers out of business with fresh severe sanctions

Eighteen US Democratic lawmakers have asked the Treasury Department and State Department to punish Israel-based spyware maker NSO Group and three other surveillance software firms for enabling human rights abuses. In a letter [PDF] signed by US Senator Ron Wyden Read More …

U.S. State Department phones hacked with Israeli company spyware

Apple Inc iPhones of at least nine U.S. State Department employees were hacked by an unknown assailant using sophisticated spyware developed by the Israel-based NSO Group, according to four people familiar with the matter. The hacks, which took place in Read More …

Fake end-to-end encrypted chat app distributes Android spyware

The GravityRAT remote access trojan is being distributed in the wild again, this time under the guise of an end-to-end encrypted chat application called SoSafe Chat. This particular RAT (remote access trojan) targets predominately Indian users, being distributed by Pakistani Read More …

New PhoneSpy Android Spyware Poses Pegasus-Like Threat

Researchers discovered new Android spyware that provides similar capabilities to NSO Group’s Pegasus controversial software. Called PhoneSpy, the mobile surveillance-ware has been spotted activity targeting South Koreans without their knowledge. PhoneSpy disguises itself as a legitimate application and gives attackers Read More …