In November 2022, Google revealed the existence of a then-unknown spyware vendor called Variston. Now, Google researchers say they have seen hackers use Variston’s tools in the United Arab Emirates.
In a report published on Wednesday, Google’s Threat Analysis Group (TAG) said it discovered hackers targeting people in the UAE who used Samsung’s native Android browser, which is a customized version of Chromium. The hackers used a set of vulnerabilities chained together and delivered via one-time web links sent to the targets by text message. Of the four vulnerabilities in the chain, two were zero-days at the time of the attack, meaning they had not been reported to the software maker and were unknown at that point, according to the new blog post by TAG.
If a target clicked on the malicious web links, they would have been directed to a landing page “identical to the one TAG examined in the Heliconia framework developed by commercial spyware vendor Variston.” (Both campaigns used the same exact and unique landing page, Google told TechCrunch. Once exploited the victim would have been infected with “a fully featured Android spyware suite” designed to capture data from chat and browser apps, according to the post.
“The actor using the exploit chain to target UAE users may be a customer or partner of Variston, or otherwise working closely with the spyware vendor,” the blog post read.
It’s unclear who is behind the hacking campaign or who the victims are. A Google spokesperson told TechCrunch that TAG observed about 10 malicious web links in the wild. Some of the links redirected to StackOverflow after exploitation and may have been the attacker’s test devices, Google said. TAG said it wasn’t clear who was behind the hacking campaign.
Samsung spokesperson Chris Langlois said that the company has “already taken necessary steps to prevent these potential exploit chains by issuing patches for the Samsung Internet app in December 2022.”
“December’s updates to the Samsung Internet app disable entry points for the remaining vulnerabilities and ensure devices are protected. We are actively collaborating with our partners to release patches for the remaining vulnerabilities as early as possible, starting in April, and recommend all users keep their devices updated with the latest software to ensure the highest level of protection possible,” Langlois said.
Ralf Wegener and Ramanan Jayaraman are the founders of Variston, according to Intelligence Online, an online news publication that covers the surveillance industry. The two owned half of the company each in 2018, according to Spanish business records.
Neither founder responded to a request for comment. Variston is headquartered in Barcelona, Spain. According to business registration records in Italy, Variston acquired the Italian zero-day research company Truel in 2018.
The hacking campaign in the UAE was discovered by Amnesty International’s Security Lab. In a press release, Amnesty said that the campaign has been active since at least 2020 and targeted both mobile phones and computers. Amnesty said they observed the exploits being delivered by a network of more than 1,000 malicious domains, “including domains spoofing media websites in multiple countries.” The organization also said they observed traces of the campaign in Indonesia, Belarus, the UAE and Italy, but these countries “likely represent only a small subset of the overall attack campaign based on the extensive nature of the wider attack infrastructure.”
Google also said on Wednesday that it discovered hackers exploiting an iOS zero-day bug, patched in November, to remotely plant spyware on users’ devices. The researchers say they observed attackers abusing the security flaw as part of an exploit chain targeting iPhone owners running iOS 15.1 and older located in Italy, Malaysia and Kazakhstan.
The flaw was found in the WebKit browser engine that powers Safari and other apps, and was first discovered and reported by Google TAG researchers. Apple patched the bug in December, confirming at the time that the company was aware that the vulnerability was actively exploited “against versions of iOS released before iOS 15.1.”
Hackers also used a second iOS vulnerability described as a PAC bypass technique that was fixed by Apple in March 2022, which Google researchers say is the exact technique used by North Macedonian spyware developer Cytrox to install its Predator spyware. Citizen Lab previously released a report highlighting widespread government use of the Predator spyware.
Google also observed hackers exploiting a chain of three Android bugs targeting devices running an ARM-based graphics chip, including one zero-day. Google said ARM released a fix, but several vendors — including Samsung, Xiaomi, Oppo and Google itself — did not incorporate the patch, resulting in “a situation where attackers were able to freely exploit the bug for several months,” Google said.
The discovery of these new hacking campaigns is “a reminder that the commercial spyware industry continues to thrive, says Google. “Even smaller surveillance vendors have access to 0-days, and vendors stockpiling and using 0-day vulnerabilities in secret poses a severe risk to the Internet.”
“These campaigns may also indicate that exploits and techniques are being shared between surveillance vendors, enabling the proliferation of dangerous hacking tools,” the blog read.
This story has been updated with a statement from Amnesty International, and Samsung.