The Hacker News Logo
Subscribe to Newsletter
CrowdSec

The Hacker News - Cybersecurity News and Analysis: surveillance malware

New Android Spyware Created by Russian Defense Contractor Found in the Wild

New Android Spyware Created by Russian Defense Contractor Found in the Wild
July 25, 2019Swati Khandelwal
Cybersecurity researchers have uncovered a new piece of mobile surveillance malware believed to be developed by a Russian defense contractor that has been sanctioned for interfering with the 2016 U.S. presidential election. Dubbed Monokle , the mobile remote-access trojan has been actively targeting Android phones since at least March 2016 and is primarily being used in highly targeted attacks on a limited number of people. According to security researchers at Lookout, Monokle possesses a wide range of spying functionalities and uses advanced data exfiltration techniques, even without requiring root access to a targeted device. How Bad is Monokle Surveillance Malware In particular, the malware abuses Android accessibility services to exfiltrate data from a large number of popular third-party applications, including Google Docs, Facebook messenger, Whatsapp, WeChat, and Snapchat, by reading text displayed on a device's screen at any point in time. The malware also extracts

China's Border Guards Secretly Installing Spyware App on Tourists' Phones

China's Border Guards Secretly Installing Spyware App on Tourists' Phones
July 03, 2019Swati Khandelwal
Chinese authorities are secretly installing surveillance apps on smartphones of foreigners at border crossings in the Xinjiang region who are entering from neighboring Kyrgyzstan, an international investigation revealed. Xinjiang (XUAR) is an autonomous territory and home to many Muslim ethnic minority groups where China is known to be conducting massive surveillance operations, especially on the activities of Uighurs, a Muslim Turkic minority group of about 8 million people. The Chinese government has blamed the Muslim Turkic minority group for Islamic extremism and deadly attacks on Chinese targets. According to a joint investigation by New York Times , the Guardian, Süddeutsche Zeitung and more, the surveillance app has been designed to instantly extract emails, texts, calendar entries, call records, contacts and insecurely uploads them to a local server set-up at the check-point only. This suggests that the spyware app has not been designed to continuously and remotely t

ISPs Caught Injecting Cryptocurrency Miners and Spyware In Some Countries

ISPs Caught Injecting Cryptocurrency Miners and Spyware In Some Countries
March 09, 2018Swati Khandelwal
Governments in Turkey and Syria have been caught hijacking local internet users' connections to secretly inject surveillance malware, while the same mass interception technology has been found secretly injecting browser-based cryptocurrency mining scripts into users' web traffic in Egypt. Governments, or agencies linked to it, and ISPs in the three countries are using Deep Packet Inspection technology from Sandvine (which merged with Procera Networks last year), to intercept and alter Internet users' web traffic. Deep packet inspection technology allows ISPs to prioritize, degrade, block, inject, and log various types of Internet traffic, in other words, they can analyze each packet in order to see what you are doing online. According to a new report by Citizen Lab, Turkey's Telecom network was using Sandvine PacketLogic devices to redirect hundreds of targeted users (journalists, lawyers, and human rights defenders) to malicious versions of legitimate progra

Mexican Govt. Allegedly Used Spyware Against Journalists, Activists & A Child

Mexican Govt. Allegedly Used Spyware Against Journalists, Activists & A Child
June 19, 2017Swati Khandelwal
After the disclosure of sophisticated global espionage and disinformation campaign aimed to discredit enemies of the state, Citizen Lab researchers exposed the dirty game of the Mexican government and its politics. The report — " Government Spy: Systematic monitoring of journalists and human rights defenders in Mexico " — published by Citizen Lab today revealed how the Mexican government used advanced spyware tools purchased from the NSO Group to target the country's most prominent human rights lawyers, anti-corruption activists, and journalists. The NSO Group, an Israel-based company that produces the most advanced mobile spyware on the planet, sold the tool to governments with an explicit agreement that it should be used only to fight terrorists or criminal groups that have long kidnapped and killed Mexicans. But, the Mexican government targets include: Lawyers looking into the case of 43 Students disappeared in September 2014 from the town of Iguala. Two

Not Just Criminals, But Governments Were Also Using MS Word 0-Day Exploit

Not Just Criminals, But Governments Were Also Using MS Word 0-Day Exploit
April 13, 2017Swati Khandelwal
Recently we reported about a critical code execution vulnerability in Microsoft Word that was being exploited in the wild by cyber criminal groups to distribute malware like Dridex banking trojans and Latentbot. Now, it turns out that the same previously undisclosed vulnerability in Word (CVE-2017-0199) was also actively being exploited by the government-sponsored hackers to spy on Russian targets since at least this January. The news comes after security firm FireEye, that independently discovered this flaw last month, published a blog post , revealing that FinSpy spyware was installed as early as January using the same vulnerability in Word that was patched on Tuesday by Microsoft. For those unaware, the vulnerability (CVE-2017-0199) is a code execution flaw in Word that could allow an attacker to take over a fully patched and up to date computer when the victim opens a Word document containing a booby-trapped OLE2link object, which downloads a malicious HTML app from a

Malware Hijacks Microphones to Spy On Ukrainian Businesses, Scientists and Media

Malware Hijacks Microphones to Spy On Ukrainian Businesses, Scientists and Media
February 21, 2017Swati Khandelwal
Ukraine has once again been a target of a potential hacking attack that infected computer systems from dozens of Ukrainian businesses with highly sophisticated malware, allowing hackers to exfiltrate sensitive data and eavesdrop on their network. Late last year, the country also suffered a power outage caused by the same group of hackers that targeted Ukraine's power grid with the BlackEnergy malware in late 2015, causing 225,000 residents to lose electricity. Now security researchers from threat intelligence firm CyberX have uncovered an advanced malware-based operation that has already siphoned over 600 gigabytes of data from about 70 victim organizations, including critical infrastructure, news media, and scientific research. Operation BugDrop: Damages and Modus Operandi Dubbed " Operation BugDrop ," the large-scale malware campaign has been perpetrated against targets in the Ukraine, though targets from other countries include Russia, Saudi Arabia, and Austr

Police Arrested Suspected Hacker Who Hacked the 'Hacking Team'

Police Arrested Suspected Hacker Who Hacked the 'Hacking Team'
January 31, 2017Swati Khandelwal
Remember the Hacker who hacked Hacking Team ? In 2015, a hacker named Phineas Fisher hacked Hacking Team – the Italy-based spyware company that sells spying software to law enforcement agencies worldwide – and exposed some 500 gigabytes of internal data for anyone to download. Now, the Spanish authorities believe that they have arrested Phineas Fisher, who was not just behind the embarrassing hack of Hacking Team, but also hacked the UK-based Gamma International, another highly secretive company which sells the popular spyware called " FinFisher ." During an investigation of a cyber attack against Sindicat De Mossos d'Esquadra (SME), Spain's Catalan police union, police in Spain have arrested three people, one of which detained in the city of Salamanca is suspected of being Fisher, according to local newspaper ARA . The cyber attack was carried out in May last year when Fisher announced via his own Twitter account that he had hacked the SME and also publ

Edward Snowden Designs an iPhone Case to Detect & Block Wireless Snooping

Edward Snowden Designs an iPhone Case to Detect & Block Wireless Snooping
July 22, 2016Swati Khandelwal
We just cannot imagine our lives without smartphones, even for a short while, and NSA whistleblower Edward Snowden had not owned a smartphone since 2013 when he began leaking NSA documents that exposed the government's global surveillance program. Snowden fears that cellular signals of the smartphone could be used to locate him, but now, to combat this, he has designed an iPhone case that would detect and fight against government snooping. With help from renowned hardware hacker Andrew "Bunnie" Huang, Snowden has devised the design, which they refer to as an " Introspection Engine, " that would keep journalists, activists, and human rights workers from being tracked by their own devices leaking their location details. "This work aims to give journalists the tools to know when their smartphones are tracking or disclosing their location when the devices are supposed to be in airplane mode," Huang and Snowden wrote in a blog post published Thu

NSA-linked Spying Malware Infected Top German Official's Computer

NSA-linked Spying Malware Infected Top German Official's Computer
October 27, 2015Swati Khandelwal
The German authorities have initiated a further investigation into espionage by the United States secret service NSA and British intelligence agency GCHQ after...   ...the head of the German Federal Chancellery unit had his private laptop infected. According to a recent report published by Der Spiegel , the laptop of the Chancellery division leader was infected with Regin – a highly advanced espionage malware program that has been linked to the National Security Agency (NSA) and its UK counterpart, the Government Communications Headquarters (GCHQ). As The Hacker News reported almost a year ago, Regin is one of the most highly advanced, sophisticated malware programs that was used to spy on a wide range of international targets including: Internet service providers (ISPs) Telecommunications backbone operators Energy firms Airlines Government entities Research institutes Other high-profile individuals …around the world since at least 2008. Regin has d

Spy Agencies Hijack Google Play Store to Install Spyware on Smartphones

Spy Agencies Hijack Google Play Store to Install Spyware on Smartphones
May 21, 2015Mohit Kumar
I have an Android phone with a five different gmail accounts configured in it. But what if any one of them get compromised via phishing, malware or any other way? The Hacker would be able to access my Google account and obviously Google Play Store account too, which allows anyone to install any Android application remotely into my phone without my knowledge and confirmation… What if someone compromises large number of Google accounts and trigger mass installation of a spying or malware app remotely with just one click???? Yes, this was exactly what the National Security Agency (NSA) had done under its widely spread Global surveillance program. A new top-secret document obtained from the former NSA contractor Edward Snowden revealed that the NSA and its closest allies planned to hijack Google and Samsung app stores to infect smartphones with spyware. The operation was launched by the Network Tradecraft Advancement Team, including spy agents from each of the coun

CASPER Surveillance Malware Linked to French Government

CASPER Surveillance Malware Linked to French Government
March 05, 2015Swati Khandelwal
Last month, cyber security researchers spotted a new strain of french surveillance malware, dubbed " Babar ," which revealed that even French Government and its spying agency the General Directorate for External Security (DGSE) is dedicatedly involved in conducting surveillance operation just like the United States — NSA and United Kingdom — GCHQ . A powerful piece of surveillance malware, known as " Casper ," has recently been discovered by the Canadian security researchers that once again point fingers at the French government. CASPER SURVEILLANCE MALWARE LINKED TO FRANCE The newly discovered sophisticated Casper surveillance malware is believed to be developed by France based hacking group suspected to have ties with the French government, according to the report published by Motherboard . Report suggests that French hacking group have developed ' Swiss Army knife of spying tools ' which has been used by French government to conduct multipl
Online Courses and Software

Sign up for cybersecurity newsletter and get latest news updates delivered straight to your inbox daily.