Surveillance firm Hacking Team hacked [Updated]

Hacking Team, the Italian surveillance firm that develops spyware and hacking software has been hacked by attackers that exfiltrated some 400Gbs of data.

The Italian security firm Hacking Team has allegedly been hacked, unknown attackers have exfiltrated some 400Gbs of data. The company has often been at the center of heated debate because of surveillance solutions that it develops, many experts and privacy advocated arguing that the company sells its products to oppressive and dictatorial regimes.

At the timeI’m writing there is no information on how the attack was carried out or even when it occurred.

The Hacking Team alleged sold its solutions to customers in Lebanon, Oman, Saudi Arabia, and Sudan, for this reason, hacktivist at Reporters Without Borders marked the company as an Enemy of the Internet.

On Sunday Eva Galperin, global policy analyst at the Electronic Frontier Foundation, shared the list of countries said to be customers of the Italian Hacking Team.


According to exploit activist Christopher Soghoian (@csoghoian) Chile allegedly bought the surveillance software last year for $US2.85 million.

The stolen data has been uploaded to BitTorrent, it includes a huge number of directories containing source code, emails, and also audio recordings.

Among the software solutions sold by the Hacking Team, there is the Da Vinci surveillance platform, a software used by law enforcement agencies to spy on suspects.

The hackers also hijacked the Hacking Team ‘s Twitter account to share screenshots of the stolen data as proof of the attack.

 

It’s curious that in the following image, the CEO of hacking team David Vincenzetti share the news related the hacking of their competitor FinFisher, another powerful surveillance software developed by Gamma Group.

The Hackers are tweeting the alleged contents of other emails from Hacking Team CEO David Vincenzetti which demonstrates that the company is doing business with oppressive governments. The torrent listings also include login credentials for the company’s support sites in Egypt, Mexico, and Turkey.

Experts that are analyzing the stolen data are starting to share news regarding the documents it includes such as:
  • The invoice for 58,000 Euro to Egypt for Hacking Team’s RCS Exploit Portal. (source Csoonline)
  • An email from a person linked to several domains allegedly tied to the Meles Zenawi Foundation (MZF), Ethiopia’s Prime Minister. In the email Biniam Tewolde thanks to Hacking Team for its services. It seems Ethiopia paid $1,000,000 Birr (ETB) for Hacking Team’s Remote Control System, professional services, and communications equipment.
  • An invoice of 480,000 Euro demonstrates that the Hacking Team have done business with Sudan with used also surveillance software to track and suppress dissidents.
  • Documents, shared by SynAckPwn with Salted Hash, related the maintenance agreement status of a number of customers includes Russia and Sudan as clients of the Hacking Team. They are flagged as “Not officially supported”.
  • Hacking Team currently has, based on internal documents leaked by the attackers on Sunday evening, customers in the following locations (source Csoonline):
    Egypt, Ethiopia, Morocco, Nigeria, Sudan, Chile, Colombia, Ecuador, Honduras, Mexico, Panama, United States ,Azerbaijan, Kazakhstan, Malaysia, Mongolia, Singapore, South Korea, Thailand, Uzbekistan, Vietnam, Australia, Cyprus, Czech Republic, Germany, Hungary, Italy, Luxemburg, Poland, Russia, Spain, Switzerland, Bahrain, Oman Saudi Arabia, UAE.
  • The Twitter account of Christian Pozzi (@christian_pozzi), a representative of the company was also hacked.

Hacking Team is verifying the material, let’s wait for official information on its authenticity

Stay Tuned …

 

[adrotate banner=”9″] [adrotate banner=”12″]

Pierluigi Paganini

(Security Affairs – Hacking Team, RCS)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

Sweden’s liquor supply severely impacted by ransomware attack on logistics company

A ransomware attack on a Swedish logistics company Skanlog severely impacted the country's liquor supply. …

20 mins ago

CISA adds Cisco ASA and FTD and CrushFTP VFS flaws to its Known Exploited Vulnerabilities catalog

CISA adds Cisco ASA and FTD and CrushFTP VFS vulnerabilities to its Known Exploited Vulnerabilities…

11 hours ago

CISA adds Microsoft Windows Print Spooler flaw to its Known Exploited Vulnerabilities catalog

U.S. CISA added the Windows Print Spooler flaw CVE-2022-38028 to its Known Exploited Vulnerabilities catalog.…

18 hours ago

DOJ arrested the founders of crypto mixer Samourai for facilitating $2 Billion in illegal transactions

The U.S. Department of Justice (DoJ) announced the arrest of two co-founders of a cryptocurrency mixer…

18 hours ago

Google fixed critical Chrome vulnerability CVE-2024-4058

Google addressed a critical Chrome vulnerability, tracked as CVE-2024-4058, that resides in the ANGLE graphics…

23 hours ago

Nation-state actors exploited two zero-days in ASA and FTD firewalls to breach government networks

Nation-state actor UAT4356 has been exploiting two zero-days in ASA and FTD firewalls since November…

1 day ago

This website uses cookies.