FinSpy Spyware for Mac and Linux OS Targets Egyptian Organisations

guest · Sep 25, 2020

FinSpy Spyware for Mac and Linux OS Targets Egyptian Organisations
September 25, 2020
https://thehackernews.com/2020/09/finspy-malware-macos-linux.html

Amnesty International today exposed details of a new surveillance campaign that targeted Egyptian civil society organizations with previously undisclosed versions of FinSpy spyware designed to target Linux and macOS systems.

Developed by a German company, FinSpy is extremely powerful spying software that is being sold as a legal law enforcement tool to governments around the world but has also been found in use by oppressive and dubious regimes to spy on activists.
FinSpy, also known as FinFisher, can target both desktop and mobile operating systems, including Android, iOS, Windows, macOS, and Linux, to gain spying capabilities, including secretly turning on their webcams and microphones, recording everything the victim types on the keyboard, intercepting calls, and exfiltration of data.

According to the human rights organization Amnesty International, the newly discovered campaign is not linked to 'NilePhish,' a hacking group known for attacking Egyptian NGOs in a series of attacks, involving an older version of FinSpy, phishing technique, and malicious Flash Player downloads.
Click to expand...

Uploaded on VirusTotal, all new malware samples were discovered as part of an ongoing effort by Amnesty International to actively track and monitor NilePhish's activities.

Moreover, even if a targeted smartphone isn't rooted, the spyware attempts to gain root access using previously disclosed exploits.

"The modules available in the Linux sample are almost identical to the MacOS sample," the researchers said.
Meanwhile, the researchers have also provided indicators of compromise (IoC) to help researchers further investigate these attacks and users check whether their machines are among compromised ones.
Click to expand...

Amnesty International: German-made FinSpy spyware found in Egypt, and Mac and Linux versions revealed

With this report, Amnesty’s Security Lab shares new insights into the capabilities of the NilePhish attacker group, as well as provides detailed analysis of newly discovered variants of FinSpy in order to enable cybersecurity researchers to further investigate and develop protection mechanisms. In addition, we hope to raise awareness among HRDs on the evolution of digital attack techniques and help address common misconceptions that Linux and Mac computers are safer against spyware attacks.
Click to expand...

guest · Sep 30, 2020

FinFisher Filleted
a triage of the FinSpy (macOS) malware
(by Patrick Wardle)
September 26, 2020
https://objective-see.com/blog/blog_0x4F.html

Recently, Claudio Guarnieri highlighted some intriguing new research published by his research lab at Amnesty International: [...]
As noted in their report:

"FinSpy is a commercial spyware suite produced by the Munich-based company FinFisher Gmbh. Since 2011 researchers have documented numerous cases of targeting of Human Rights Defenders (HRDs) - including activists, journalists, and dissidents with the use of FinSpy in many countries, including Bahrain, Ethiopia, UAE, and more."
In this blog post, we provide a hands-on triage of the macOS variant of FinSpy. We build upon Amnesty International’s (great) research, as well as cover new components of the malware, such as it’s kernelmode rootkit component. [...]
Click to expand...

Conclusion
Today, we triaged FinFisher’s macOS implant, FinSpy.

Although rather somewhat dated, it provided an intriguing look into the world of commercial cyber-espionage malware. And yes, the exploits it leveraged were all public (and long patched) and its rootkit capabilities were rather mundane …but let’s not forget that a more modern version of this threat (or similar commercial implant) could be far more sophisticated!
Click to expand...

Log in or Sign up

FinSpy Spyware for Mac and Linux OS Targets Egyptian Organisations

guest Guest

guest Guest

Log in or Sign up

FinSpy Spyware for Mac and Linux OS Targets Egyptian Organisations

guest Guest

guest Guest

Useful Searches