Google’s Threat Analysis Group (TAG) (via) techcrunchThis confirms earlier findings by security research group Lookout, which linked spyware, called Hermit, to Italian spyware vendor RCS Labs.
Lookout says RCS Labs is doing similar work to NSO Group — the infamous surveillance-for-hire company behind Pegasus spyware — and sells commercial spyware to various government agencies. Researchers at Lookout believe the Hermit has already been deployed by the Kazakhstani government and Italian authorities. In line with these findings, Google has identified victims in both countries and said it will notify affected users.
As described in Lookout’s report, Hermit is a modular threat that can download additional capabilities from a command and control (C2) server. This allows spyware to access call records, locations, photos and text messages on the victim’s device. The Hermit is capable of recording audio, making and intercepting phone calls, as well as rooting an Android device, which gives it complete control over its core operating system.
Apps with Hermit were never made available through Google Play or the Apple App Store
Spyware can infect both Android and iPhone by disguising itself as a legitimate source, usually in the form of a mobile carrier or messaging app. Cybersecurity researchers at Google found that some attackers actually worked with ISPs to siphon off a victim’s mobile data in order to advance their plan. Bad actors will then masquerade as the victim’s mobile carrier over SMS and trick users into believing that a malicious app download will restore their internet connectivity. If the attackers were unable to work with the ISP, Google says they tricked users into downloading what appeared to be an authentic messaging app.
Researchers from Lookout and TAG say that apps with Hermit were never made available through Google Play or the Apple App Store. However, attackers were able to distribute infected apps on iOS by enrolling in Apple’s Developer Enterprise Program. This allowed bad actors to bypass the App Store’s standard checking process and obtain a certificate that “meets all iOS code signing requirements on any iOS device.”
apple told ledge That it has since revoked any account or certificate associated with the threat. Apart from notifying the affected users, Google has also rolled out the Google Play Protect update to all users.
