Posts with #Intellexa
Public posts on X that use #Intellexa.
blackorbird @blackorbirdA full iOS zero-day exploit chain used in the wild against targets in Egypt. #Intellexa #Predator Stage 1: Initial RCE via JSKit Framework (Safari WebKit Exploitation)Entry Point: The chain starts with a zero-day RCE vulnerability in Safari's WebKit rendering engine, patched by Apple as CVE-2023-41993 (a memory corruption issue in the JIT compiler). Stage 2: Sandbox Escape and Kernel Privilege EscalationVulnerabilities Exploited: CVE-2023-41992: Kernel IPC use-after-free (sandbox escape + local privilege escalation, LPE). CVE-2023-41991: Code-signing bypass (LPE). Stage 3: Persistence and Surveillance Setup (PREYHUNTER Modules)Components: Divided into two modules—"watcher" and "helper"—deployed via the escalated privileges from Stage 2.
John Scott-Railton @jsrailton7/ Primer: some recent #Predator & #Intellexa scandals: #Greece: massive #Predatorgate political targeting scandal. Targets included Americans. #Egypt: presidential Candidate targeted #Predator used to target US officials & journalists.👇
John Scott-Railton @jsrailton@AmnestyTech @SenJohnHoeven @RepMcCaul @iblametom 7/ Which brings us to this latest @AmnestyTech report, which proves that despite the @USTreasury sanctions (that began in March 24)... Intellexa kept right on facilitating hacking abuses in places like Angola... THE REPORT:
blackorbird @blackorbirdTo Catch a #Predator: Leak exposes the internal operations of #Intellexa’s mercenary spyware Intellexa’s Predator employs advanced infection vectors for mobile devices, including 1-click exploits via malicious links targeting Chrome (Android) and Safari (iOS) vulnerabilities, tactical tools like Triton (Exynos baseband exploit) for proximity-based attacks, and strategic zero-click methods such as Mars/Jupiter (ISP-injected links) and Aladdin (malicious ads via IP targeting in ad ecosystems). Data exfiltration captures encrypted messages (e.g., Signal, WhatsApp), audio, locations, and credentials, relaying them through multi-layer anonymization chains to customer backends using AES/RSA encryption and throttled uploads based on device battery/network status. Command-and-control infrastructure features on-premises servers (infection, CNC, dashboards like PDS/CyOP) accessible remotely via TeamViewer, with real-time logs and Elasticsearch monitoring. Evasion tactics include self-destruction (Guard module), resource throttling, certificate pinning, and obfuscated filenames (e.g., pred. so, fs.db) to mimic legitimate processes and avoid forensics.
