2025-11-08
It seems like DNG image processing libraries became a new attack vector of choice - suspiciously consistent across campaigns. Samsung had two zero-days in the same library, while a parallel campaign hit iOS - all exploiting the same file format. Should we expect more? 👀 3/
The Record
Unit 42: “commercial grade” spyware called Landfall, likely zero-click, was used in a hacking campaign aimed at Samsung Galaxy phones in the Middle East
Security researchers on Friday revealed the discovery of “commercial grade” spyware used in a 9-month-long hacking campaign aimed …
This isn't an isolated incident. #LANDFALL is part of a larger DNG exploitation wave. Within months, attackers weaponized image parsing vulnerabilities across Samsung (CVE-2025-21042, CVE-2025-21043) and Apple (CVE-2025-43300 chained with WhatsApp CVE-2025-55177 for delivery). 2/ [image]
The Record
Unit 42: “commercial grade” spyware called Landfall, likely zero-click, was used in a hacking campaign aimed at Samsung Galaxy phones in the Middle East
Security researchers on Friday revealed the discovery of “commercial grade” spyware used in a 9-month-long hacking campaign aimed …
In its debug strings, LANDFALL's loader calls itself “Bridge Head”. That's notable — “Bridge Head” is a common nickname used by some private-sector offensive cyber companies (including Variston, NSO, and others) for first-stage loaders. 6/ [image]
The Record
Unit 42: “commercial grade” spyware called Landfall, likely zero-click, was used in a hacking campaign aimed at Samsung Galaxy phones in the Middle East
Security researchers on Friday revealed the discovery of “commercial grade” spyware used in a 9-month-long hacking campaign aimed …
#LANDFALL enabled comprehensive surveillance, including microphone recording, location tracking and collection of photos, contacts, call logs, and more. Our analysis focuses on its loader component, which serves as the entry point for a broader LANDFALL framework. 5/
The Record
Unit 42: “commercial grade” spyware called Landfall, likely zero-click, was used in a hacking campaign aimed at Samsung Galaxy phones in the Middle East
Security researchers on Friday revealed the discovery of “commercial grade” spyware used in a 9-month-long hacking campaign aimed …