BTC $103120.4109
ETH $2328.9379
XRP $2.3548
BNB $634.7833
SOL $171.7345
DOGE $0.2050
ADA $0.7805
TRX $0.2615
stETH $2324.4955
WBTC $103040.5197
SUI $3.8936
LINK $15.9904
wstETH $2793.5225
AVAX $23.0719
XLM $0.2941
USDS $0.9997
HBAR $0.2006
HYPE $25.0884
TON $3.2630
LEO $8.7464
BCH $408.2446
LTC $99.1395
DOT $4.7569
WETH $2326.0845
XMR $311.9474
BTCB $103186.1791
BGB $4.4805
weETH $2480.5567
BSC-USD $0.9985
PEPE $0.0000
PI $0.7238
USDE $1.0000
WBT $30.3207
TAO $424.6399
UNI $6.2921
NEAR $2.8876
APT $5.4978
CBBTC $103063.4337
DAI $0.9993
OKB $53.7125
AAVE $209.8875
ONDO $1.0059
CRO $0.1019
ETC $19.0675
ICP $5.4064
TRUMP $14.2780
KAS $0.1037
BTC $103120.4109
ETH $2328.9379
XRP $2.3548
BNB $634.7833
SOL $171.7345
DOGE $0.2050
ADA $0.7805
TRX $0.2615
stETH $2324.4955
WBTC $103040.5197
SUI $3.8936
LINK $15.9904
wstETH $2793.5225
AVAX $23.0719
XLM $0.2941
USDS $0.9997
HBAR $0.2006
HYPE $25.0884
TON $3.2630
LEO $8.7464
BCH $408.2446
LTC $99.1395
DOT $4.7569
WETH $2326.0845
XMR $311.9474
BTCB $103186.1791
BGB $4.4805
weETH $2480.5567
BSC-USD $0.9985
PEPE $0.0000
PI $0.7238
USDE $1.0000
WBT $30.3207
TAO $424.6399
UNI $6.2921
NEAR $2.8876
APT $5.4978
CBBTC $103063.4337
DAI $0.9993
OKB $53.7125
AAVE $209.8875
ONDO $1.0059
CRO $0.1019
ETC $19.0675
ICP $5.4064
TRUMP $14.2780
KAS $0.1037
  • Catalog
  • Blog
  • Tor Relay
  • Jabber
  • One-Time notes
  • Temp Email
  • What is TOR?
  • We are in tor
  • SEKOIA Reveals Lycantrox Spy Campaign Infrastructure

    Which nations have been discovered snooping on their citizens without authorization?

     

    Researchers from Citizen Lab released a report last month detailing how former Egyptian lawmaker Ahmed Eltantawi's iPhone was targeted by hackers using Cytrox's Predator spyware.

    Eltantawi was the target of a redirect attack to malicious websites in August and September of this year that installed the Predator spyware by using iOS zero-day vulnerabilities (CVE-2023-41991, CVE-2023-41992, and CVE-2023-41993). This attack, as anticipated, was motivated by politics.

    In the past, Cytrox has drawn attention for using Predator to target celebrities. The activities of Cytrox and its parent company Intellexa were being investigated at the time by Citizen Lab and the now-banned Meta*.

    A report from SEKOIA that was published in December 2021 looked at potential connections between Operation Lycantrox-tracked Cytrox clients and Operation Karkadann-tracked Candiru clients. Both spy operations compromised their targets using a similar infrastructure.

    Most recently, SEKOIA experts discovered numerous domains connected to this group while analyzing the infrastructure used by Lycantrox. Examples include "elwatnanews[.]com," which poses as a news source, and "bitshort[.]info," which poses as a link shortening service.

    The researchers identified 121 distinct domain names that were highly confidently connected to the Lycantrox infrastructure. Many of these domains are somehow connected to cybercrime and have connections to servers that accept cryptocurrency payments.

    The servers connected to the identified domains are located in Madagascar, Indonesia, Kazakhstan, and Angola, according to a thorough analysis of the threat. Researchers think local government agencies use them to spy online on different politicians, activists, and journalists.

    The experts promised to keep an eye on the actions of cyber mercenaries from Cytrox and Intellexa while exposing their infrastructure and providing all identified indicators of compromise of the Lycantrox espionage campaign in their report.

    Author reign3d
    Israel is under siege online by Hamas, which has launched numerous cyberattacks against it
    Rhysida ransomware takes government services of Portugal and the Dominican Republic offline

    Comments 0

    Add comment