{"id":19464,"date":"2022-06-29T02:10:12","date_gmt":"2022-06-29T10:10:12","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2022\/06\/29\/news-13197\/"},"modified":"2022-06-29T02:10:12","modified_gmt":"2022-06-29T10:10:12","slug":"news-13197","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2022\/06\/29\/news-13197\/","title":{"rendered":"Hermit spyware is deployed with the help of a victim’s ISP"},"content":{"rendered":"

Credit to Author: Jovi Umawing| Date: Wed, 29 Jun 2022 10:03:54 +0000<\/strong><\/p>\n

Google’s Threat Analysis Group (TAG) has revealed a sophisticated spyware activity<\/a> involving ISPs (internet service providers) aiding in downloading powerful commercial spyware onto users’ mobile devices. The spyware, dubbed Hermit, is reported<\/a> to have government clients much like Pegasus.<\/p>\n

Italian vendor RCS Labs developed Hermit. The spyware was spotted in Kazakhstan (to suppress protests against government policies), Italy (to investigate those involved in an anti-corruption case), and Syria (to monitor its northeastern Kurdish region), all deployed by their respective governments. <\/p>\n

Hermit affects Android and iOS devices and is described as a modular spyware. This means it can download pieces of itself (modules) for additional functionalities, making it customizable to suit client needs, from a C2 (command and control)<\/a> server.<\/p>\n

Unlike NSO’s Pegasus, Hermit is not as stealthy. But at its core, it functions like any government-grade spyware. It can read SMS and chat messages, view passwords, intercept calls, record calls and ambient audio, redirect calls, and pinpoint precise locations of victims. <\/p>\n

Hermit also roots all infected Android devices, giving itself deeper access to phone features and user data. On iOS, Hermit is packed with six exploits, two of which were targeting zero-day<\/a> vulnerabilities. According to Google’s report, these are the following exploits:<\/p>\n