Recent news reports have indicated that spyware firms are increasingly targeting iOS, Android, and Windows devices due to the widespread usage of these platforms, making them lucrative targets for gathering sensitive information.
The dominance of iOS and Android in the mobile market, coupled with the widespread use of Windows as a primary operating system for computers, provides diverse avenues for surveillance and data collection.
In response to this growing threat, Meta Platforms took action against eight surveillance-for-hire firms in Italy, Spain, and the UAE, as detailed in the Q4 2023 “Adversarial Threat Report.” According to cybersecurity researchers at Meta Platform, spyware from these companies has been actively targeting iPhones, Android, and Windows devices.
The malware used by these spyware firms possesses stealthy features and capabilities that enable threat actors or operators to collect sensitive information from the targeted devices. This includes accessing and collecting location data, photos, media, contacts, calendar entries, emails, SMS, social media, messaging apps, as well as enabling access to the device’s microphone, camera, and screenshots.
The spyware firms involved in these activities have been identified as Cy4Gate/ELT Group, RCS Labs, IPS Intelligence, Variston IT, TrueL IT, Protect Electronic Systems, Negg Group, and Mollitiam Industries. Researchers have also uncovered that these firms are engaged in other malicious activities such as scraping, social engineering, and phishing targeting a wide range of social platforms.
For example, fake personas linked to RCS Labs deceived users for phone numbers, email addresses, and surveillance, while Variston IT’s Facebook and Instagram accounts were used for exploit development and testing. Meta reports indicate that Variston IT is discontinuing operations, and Negg Group and Mollitiam Industries were also identified for spyware testing and data collection.
Swedish telecom security firms suspect that the cyber attack method involves a unique binary SMS (MM1_notification.REQ) notifying of MMS, retrieved via MM1_retrieve.REQ and MM1_retrieve.RES, embedding device info in a GET request as a fingerprint. Additionally, the method has potential for spyware deployment, tailored exploits, and phishing campaigns, but there is no recent evidence of exploitation in the wild.
The increasing threat posed by these spyware firms targeting multiple platforms underscores the need for enhanced cybersecurity measures to protect user data and privacy. As surveillance and data collection activities continue to escalate, businesses, organizations, and individuals must remain vigilant and proactive in safeguarding their digital assets and devices.
For the latest cybersecurity news, whitepapers, and infographics, follow industry updates on LinkedIn and Twitter to stay informed and protected against evolving threats and vulnerabilities.