The Discovery of a Government Malware and an Unexpected Spy Scandal
summary
Investigation shows an Italian contractor called eSurv sells spyware named Exodus via 25 Play Store apps that install a two‑stage implant: a dropper that harvests IMEI and phone number and a RAT that records calls, messages, mic, photos and app data. Command servers use an unencrypted no TLS reverse shell and open ports that let anyone on the same network tamper with evidence. Fewer than 1,000 Italian victims appear; prosecutors link ~200 of 800 targets to unauthorized monitoring and the CEO and CTO face house arrest after a €300,000 police contract and AWS‑hosted servers are exposed.
AI-written summary · about
chapters (14)
- 0:00Introduction to spyware
- 2:16Investigating Exodus
- 4:08The phishing campaign
- 7:22Analyzing the malware
- 10:01Malware capabilities
- 12:55iOS version and issues
- 14:20Uncovering the victims
- 16:12Attribution techniques
- 18:25Identifying the company
- 22:04Publishing the story
- 24:52Aftermath of the investigation
- 30:00History of lawful intercept
- 36:42The spyware market today
- 42:05Future of surveillance
related talks
56mCybersecurity & Privacy From The Global Lens
26mThe Secret Life of Sandworms
44mBehind the Scenes: How Criminal Enterprises Pre-infect Millions of Mobile Devices
32mUsing Geopolitical Conflicts for Threat Hunting
26mTracking the World's Dumbest Cyber Mercenaries
49mThe State Of Malware From The Eye Of The Tiger
30mReversing Mobile Malware
40mJill and the BeenSTALKed