Companies that develop spyware and offer espionage services to government agencies and threat actors around the world are growing in number, and to make matters worse, for all of them, business is good.
That's according to a new report from Google, which highlights growing concerns about commercially developed spyware.
Now, according to Google's latest Buying Spying report, it tracks around 40 commercial surveillance vendors (CSV). Some are more popular than others, but all play an important role in the development of spyware, he said. One of its most important functions is to discover zero-day vulnerabilities. In fact, Google claims that CSVs are behind half of the known zero-day exploits targeting Google products and the Android ecosystem.
Buy spy
Commercial spyware companies have made headlines in recent weeks due in large part to the exploits of NSO Group. This Israel-based startup developed a tool called Pegasus and claimed that it was designed to help governments around the world defend against terrorist attacks and similar threats. Instead, Pegasus was found to be used against government officials in the UK and EU, with many cybersecurity researchers and privacy advocates warning that Pegasus was used against government opponents, journalists, intellectuals or dissidents. This led the United States, for example, to blacklist NSO Group.
Furthermore, the demand for “turnkey spy solutions” is increasing. CSVs offer paid packages that not only abuse zero-days to bypass cybersecurity solutions and antivirus programs, but also spyware and the infrastructure necessary to collect and exfiltrate sensitive information from targets.
CSVs include those who work on vulnerability discovery, those who work on selling exploits, those who create spyware solutions, and finally the government customers who purchase these packages and drive this industry.
“CSVs have proliferated hacking and spyware capabilities that weaken Internet security for everyone. That's why we discovered and patched vulnerabilities used by CSVs, shared intelligence strategies and fixes with industry peers, and published information about the operations we disrupted,” Google researchers concluded.
