A sophisticated spyware campaign is acquiring the help of internet service providers (ISPs) to trick users into downloading malicious apps, according to research posted by Google’s Threat Analysis Group (TAG).
It confirms earlier conclusions from security research group Lookout, which has linked the spyware, dubbed Hermit, to Italian spyware vendor RCS Labs.
Lookout says RCS Labs is in the exact line of work as NSO Group — the notorious surveillance-for-hire company behind the Pegasus spyware — and hawks commercial spyware to various government agencies. Investigators at Lookout believe Hermit has already been deployed by the state of Kazakhstan and Italian authorities. In line with these findings, Google has recognized victims in both countries and says it will notify concerned users.
Lookout’s report describes that Hermit is a modular threat that can download additional capabilities from a command and control (C2) server. It permits the spyware to access the call records, location, images, and text messages on a victim’s device. Hermit’s also competent in recording audio, making and blocking phone calls, and root to an Android device, giving it control over its core operating system.
The spyware can contaminate Android and iPhones by disguising itself as a legitimate source, typically as a portable carrier or messaging app. Google’s cybersecurity experimenters found that some attackers operated with ISPs to switch off a victim’s mobile data to further their scheme.
Evil actors would then pose as a victim’s mobile carrier over SMS and trick users into acknowledging that a malicious app download will restore their internet connectivity. If attackers could not operate with an ISP, Google says they posed as seemingly authentic messaging apps that deceived users into downloading.
Researchers from Lookout and TAG say apps, including Hermit, were never made available thru the Google Play or Apple App Store. However, attackers could broadcast infected apps on iOS by registering in Apple’s Developer Enterprise Program. It allowed terrible actors to bypass the App Store’s standard vetting procedure and obtain a certificate that “fulfills all of the iOS code signing conditions on iOS devices.”
Apple said it has since revoked any accounts or certificates associated with the danger. In addition to informing affected users, Google has also pushed a Google Play Protect update to all users.
Cyber threats protect internet-connected systems such as hardware, software, and data. Individuals and enterprises use the practice to protect against unauthorized access to data headquarters and other computerized systems.
A robust cybersecurity approach can deliver a sound security posture against vicious attacks designed to access, alter, delete, destroy or squeeze an organization’s or user’s systems and sensitive data. Cybersecurity is also instrumental in stopping attacks that disable or disrupt a system’s or device’s operations.
With an increasing digit of users, devices, and programs in the modern enterprise, combined with the growing deluge of data — much of which is sensitive or confidential — the importance of cybersecurity continues to grow. In addition, the ever-increasing volume and sophistication of cyber attackers and attack strategies compound the problem even further.
The cybersecurity domain can be broken down into several different provinces, the coordination of which within the organization is essential to the success of a cybersecurity program. These sections include the following:
Maintaining cybersecurity in a continually evolving threat landscape is challenging for all organizations. Traditional reactive techniques, in which resources were put toward protecting systems against the most significant known threats while more secondary known threats were undefended, are no longer an acceptable tactic. Instead, a more proactive and adaptive approach is necessary to keep up with changing security risks. Several key cybersecurity advisory organizations suggest guidance. For instance, the National Institute of Standards and Technology (NIST) means adopting continuous monitoring and real-time assessments as parts of a risk assessment framework to protect against known and unknown threats.
Benefits of Cybersecurity
- Business protection against cyberattacks and data breaches
- Protection for data and networks
- Prevention of unauthorized user access
- Improved recovery time after a breach
- Protection for end users and endpoint devices
- Regulatory compliance.
- Business continuity.
- Improved confidence in the company’s reputation and trust for developers, partners, customers, stakeholders, and employees.
Types of Cybersecurity Threats
The process of keeping up with new technologies, security trends, and threat intelligence is a challenging task. First, it is necessary to protect information and other assets from cyber threats, which take many forms. Types of cyber threats include:
Malware is a form of malicious software in which any file or program can be used to harm a computer user. It includes worms, viruses, Trojans, and spyware.
Ransomware is another type of malware. It involves an attacker locking the victim’s computer system files — typically through encryption — and demanding a payment to decrypt and unlock them.
Social engineering is an attack that relies on human interaction to trick users into breaking security procedures to gain sensitive information that is typically protected.
Phishing is a form of social engineering where fraudulent email or text messages that resemble those from reputable or known sources are sent. Often random attacks, these messages intend to steal sensitive data, such as credit card or login information.
Spear phishing is a phishing attack on an intended target user, organization, or business.
Insider threats are security breaches or losses caused by humans, employees, contractors, or customers. Insider threats can be malicious or negligent.
Distributed denial-of-service (DDoS) attacks are those in which multiple systems disrupt the traffic of a targeted approach, such as a server, website, or another network resource. By flooding the target with messages, connection requests, or packets, the attackers can slow the system or crash it, preventing legitimate traffic from using it.
Advanced persistent threats (APTs) are prolonged targeted attacks in which an attacker infiltrates a network and remains undetected for long periods to steal data.
Man-in-the-middle (MitM) attacks are eavesdropping attacks that involve an attacker intercepting and relaying messages between two parties who believe they are communicating with each other.
Other common attacks include botnets, drive-by-download attacks, exploit kits, malvertising, vishing, credential stuffing attacks, cross-site scripting (XSS) attacks, SQL injection attacks, and business email compromise (BEC) and zero-day exploits.