Windows 익스플로잇 및 DevilsEye 스파이웨어는 이스라엘 회사 Candiru와 관련되어 있습니다.

Specialists from 마이크로 소프트Citizen Lab spoke about the DevilsEye spyware, which was developed by the Israeli company Candiru, and then sold to governments of different countries. DevilsEye detected at least 100 high-ranking targets on the systems, while 0-day vulnerabilities in browsers and Windows were used for infecting them.

The researchers say the Israeli company Candiru is behind the development of at least two exploits for zero-day vulnerabilities in Windows that have been used to attack and deploy the previously unknown DevilsEye spyware. This malware has affected politicians, human rights defenders, activists, journalists, 중국과 연결된 APT 그룹 Hafnium은 손상된 Windows 시스템에서 지속성을 보장하기 위해 새로운 Tarrask 악성코드를 사용하기 시작했습니다., embassies and political dissidents around the world.

It is known that Candiru (Microsoft calls it the codename Sourgum) was founded in 2014. And although its vacancies have long made it clear that the company is engaged in cybersecurity issues, previously they knew almost nothing about Candiru’s activities. 지금, thanks to reports from Microsoft and Citizen Lab, it’s clear that the company’s tools are helping its customers infect and take over control of iPhone, 기계적 인조 인간, Mac, PC, and cloud accounts.

Candiru is a secret Israeli company that exclusively sells spyware to governments.Citizen Lab said.

This spyware was first spotted by Citizen Lab researchers when they were conducting a cyber-forensic examination of a device belonging to an unnamedpolitical activist from Western Europe.By sharing their findings with Microsoft, researchers were able to locate at least 100 other DevilsEye victims in countries such as Palestine, Israel, Iran, Lebanon, Yemen, 스페인, the United Kingdom, 칠면조, Armenia, and Singapore.

DevilsEye spread by luring victims to malicious sites hosting an exploit kit that abused various browser vulnerabilities to install malware on victims’ 장치. Subsequently, in the second phase of the attack, a Windows exploit was used to allow attackers to elevate their privileges to administrator level.Microsoft experts write.

The researchers emphasize that the chain of attacks was complex and exploited until recently unknown zero-day vulnerabilities: in the Chrome browser (CVE-2021-21166CVE-2021-30551), in Internet Explorer (CVE-2021-33742), and two more in Windows (CVE-2021-31979CVE-2021-33771). 현재, manufacturers have already fixed all these problems.

The first three vulnerabilities were already mentioned in a recent report from Google, which also linked attacks on vulnerabilities in Chrome and IE to an unnamedcommercial surveillance company.Google said the bugs were sold to at least two groups ofgovernment hackerswho used them to attack targets in Armenia. Now Google has updated its report and also links the exploitation of these problems with Israeli Candiru.

DevilsTongue enables its carriers to steal victimsfiles, decrypt and steal messages from Signal on Windows devices, and steal cookies and saved passwords from Chrome, 인터넷 익스플로러, 파이어 폭스, Safari and Opera browsers.

DevilsTongue may also use cookies stored on the victim’s computer for sites such as Facebook, 지저귀다, Gmail, 야후, Mail.ru, Odnoklassniki and Vkontakte to collect confidential information, read messages and extract photos. On some of the listed sites, the spyware can even send messages on behalf of the victim to other people. Some of the anti-spyware tools can prevent such a behaviour, but stopping it requires additional efforts.

Citizen Lab analysts say that Candiru’s hack-for-hire capabilities far exceed what Google and Microsoft experts have predicted. According to Citizen Lab, 이상 750 domains have already been discovered that hosted Candiru, including large clusters in the UAE and Saudi Arabia, suggesting that these two countries are some of the company’s largest customers.

Some of these domains have masked as human rights organizations such as Amnesty International, the Black Lives Matter movement, and media companies, leading experts to conclude that the attacks were mainly directed against activists.

Christine Goodwin, Microsoft’s head of digital security, writes that companies like Candiru have been supplying cyber weapons to attackers for years, and governments in many countries use these hacking tools against civil society members, not to track down criminals. Goodwin calls for the fight against such companies, whose products are actively used to violate human rights.

A world in which private sector companies manufacture and sell cyber weapons is becoming more dangerous for consumers, businesses of all sizes, and even governments.Goodwin writes.

You can also read here that BIOPASS malware uses OBS Studio streaming software to record victim screens and Spyware Terminator 가짜 시스템 최적화 프로그램을 제거하는 방법?

헬가 스미스

저는 항상 컴퓨터 과학에 관심이있었습니다, 특히 데이터 보안 및 테마, 요즘은 "데이터 과학", 10 대 초반부터. 편집장으로 바이러스 제거 팀에 오기 전, 저는 여러 회사에서 사이버 보안 전문가로 일했습니다., 아마존 계약자 중 한 명 포함. 또 다른 경험: 나는 Arden과 Reading 대학에서 가르치고 있습니다..

회신을 남겨주

이 사이트는 스팸을 줄이기 위해 Akismet 플러그를 사용. 귀하의 코멘트 데이터가 처리되는 방법 알아보기.

맨 위로 버튼