serverok

Search results for tag #android

hasamba » 2025-11-08
@hasamba@infosec.exchange

🎯 Threat Intelligence
===================

Executive summary: Unit 42 researchers identified a previously undocumented Android spyware family named LANDFALL that targeted Samsung Galaxy devices. The malware was delivered via malformed DNG image files exploiting a Samsung image‑processing zero‑day, tracked as CVE-2025-21042, and was active in the wild from mid‑2024 until Samsung issued a patch in April 2025.

Technical details:
• Malware family: LANDFALL — commercial‑grade Android spyware with comprehensive surveillance capabilities.
• Delivery vector: malformed DNG image files embedded in messaging workflows; WhatsApp is the reported delivery channel in analyzed samples.
• Vulnerability exploited: CVE-2025-21042 in Samsung’s image processing library; related issues (including CVE-2025-21043) were patched subsequently.
• Capabilities observed: microphone recording, continuous or on‑demand location collection, exfiltration of photos, contacts and call logs.

Analysis:
The operation exhibits tradecraft and infrastructure patterns consistent with private‑sector offensive actors operating in the Middle East. LANDFALL’s use of image‑based exploitation mirrors contemporaneous exploit chains seen on other mobile platforms, indicating cross‑platform technique reuse by advanced operators. The campaign’s timeline—active months before public disclosure—demonstrates stealthy targeted operations leveraging zero‑day access.

Attack Chain Analysis:
• Initial Access: crafted DNG images delivered via messaging application (samples linked to WhatsApp delivery).
• Exploitation: memory corruption in Samsung image processing library exploited by malformed DNG (CVE-2025-21042).
• Execution/Delivery: payload unpacked and persisted as Android spyware.
• Collection: microphone audio, location telemetry, photos, contacts, call logs.
• Exfiltration/C2: not publicly detailed in the report; infrastructure overlaps suggest commercial spyware tradecraft.

Detection:
Detection options reported by Unit 42 focus on indicators associated with malformed DNG artifacts, unexpected image parsing crashes, and behavioral telemetry showing unauthorized access to microphone, location, and media stores. Network and device telemetry that flags image processing exceptions correlated with post‑exploit binaries should be prioritized for forensic review.

Mitigation and response:
Samsung issued a patch for CVE-2025-21042 in April 2025, and later patched a related zero‑day (CVE-2025-21043) in September 2025. Palo Alto Networks lists Advanced WildFire, Advanced URL Filtering, Advanced DNS Security and Advanced Threat Prevention as protective layers for customers. Unit 42 recommends incident response engagement for suspected compromises.

References: CVE‑2025‑21042, CVE‑2025‑21043, LANDFALL, Unit 42 #LANDFALL #CVE-2025-21042 #Android #Samsung

🔗 Source: https://unit42.paloaltonetworks.com/landfall-is-new-commercial-grade-android-spyware/