Pierluigi Paganini
April 12, 2023
Citizen Lab researchers reported that at least five civil society members were victims of spyware and exploits developed by the Israeli surveillance firm QuaDream.
The victims include journalists, political opposition figures, and an NGO worker located in North America, Central Asia, Southeast Asia, Europe, and the Middle East.
The researchers also believe that the threat actors used a suspected iOS 14 zero-click exploit to deploy QuaDream’s spyware. The zero-day exploit, dubbed ENDOFDAYS, appears to work against iOS versions 14.4 and 14.4.2, and possibly other versions. ENDOFDAYS relies on invisible iCloud calendar invitations sent from the spyware’s operator to victims.
CitizenLab identified QuaDream servers in multiple countries, including Bulgaria, Czech Republic, Hungary, Ghana, Israel, Mexico, Romania, Singapore, United Arab Emirates (UAE), and Uzbekistan.
The experts believe that the zero-day exploit was used at least since March 2021.
“QuaDream Ltd (קוודרים בע”מ) is an Israeli company that specialises in the development and sale of advanced digital offensive technology to government clients. The company is known for its spyware marketed under the name “Reign”, which, like NSO Group’s Pegasus spyware, reportedly utilises zero-click exploits to hack into target devices.” reads the report published by Citizen Lab.
The Israeli firm has had a partnership with a Cypriot firm called InReach, with whom it is currently embroiled in a legal dispute. Multiple key figures of both companies have prior connections with the surveillance vendor Verint, as well as Israeli intelligence agencies.
The victims were identified using a set of indicators of compromise based on an analysis of samples shared with Citizen Lab by Microsoft Threat Intelligence.
“Microsoft Threat Intelligence analysts assess with high confidence that a threat group tracked by Microsoft as DEV-0196 is linked to an Israel-based private sector offensive actor (PSOA) known as QuaDream. QuaDream reportedly sells a platform they call REIGN to governments for law enforcement purposes. REIGN is a suite of exploits, malware, and infrastructure designed to exfiltrate data from mobile devices.” reads the post published by Microsoft.
The researchers noted that one of the samples they analyzed was using a functionality that in some cases leaves traces behind on infected devices after the spyware is removed. The experts called the traces left by the functionality as the Ectoplasm Factor.
Microsoft provided technical details of QuaDream iOS malware, it tracked as KingsPawn, including indicators of compromise.
The malware is composed of a monitor agent, which is a native Mach-O file written in Objective-C, and the main agent that is also a native Mach-O file and is written in Go language.
The monitor agent is designed to reduce the forensic footprint of the malicious code to avoid detection, while the main agent supports sophisticated spying capabilities.
In February 2022, the Reuters agency first reported QuaDream capabilities, after that one of the vulnerabilities in Apple iOS (FORCEDENTRY zero-click exploit) that was previously exploited by the spyware developed by the Israeli company NSO Group was also separately used by the surveillance firm.
“Ultimately, this report is a reminder that the industry for mercenary spyware is larger than any one company, and that continued vigilance is required by researchers and potential targets alike.” concludes Citizen Lab. “Until the out-of-control proliferation of commercial spyware is successfully curtailed through systemic government regulations, the number of abuse cases is likely to continue to grow, fueled both by companies with recognizable names, as well as others still operating in the shadows.”
Please vote for Security Affairs (https://securityaffairs.com/) as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections:
Please nominate Security Affairs as your favorite blog.
Nominate here: https://docs.google.com/forms/d/e/1FAIpQLSfaFMkrMlrLhOBsRPKdv56Y4HgC88Bcji4V7OCxCm_OmyPoLw/viewform
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, zero-day)
