Mapping the Web of Commercial Spyware: Targets and Attack Chains

Cybersecurity: Commercial Spyware Vendors

A new report, covering the period from 2010 to 2025, examines the landscape of commercial spyware vendors (CSVs). It details the methods employed by these firms to infiltrate devices, their common targets, and the infection chains used to deploy covert implants.

The study, produced by a cybersecurity intelligence firm, highlights the persistent threat posed by CSVs. This includes early entities such as FinFisher and Hacking Team, as well as current major players like NSO Group, Candiru, and the Intellexa consortium.

The report traces the emergence of commercial spyware to the post-Arab Spring era, where governments sought surveillance tools to monitor social media-fueled uprisings. Between 2010 and 2015, vendors such as Gamma Group and Italy’s Hacking Team provided tools like FinFisher and Remote Control System (RCS), enabling governments to monitor activists through phishing and malicious exploits.

European firms like Amesys provided solutions like “Eagle,” a deep-packet-inspection tool used for mass internet monitoring, later transitioning to Intellexa’s Predator spyware.

Between 2016 and 2021, CSVs evolved to offer comprehensive services, integrating intrusion vectors, command-and-control infrastructures, multilingual dashboards, and data exfiltration modules. Vulnerability researchers and exploit developers contributed new vulnerabilities to maintain surveillance operations.

The advent of zero-click and one-click implants marked a significant shift. For instance, NSO Group’s Pegasus initially exploited iOS vulnerabilities through single-click methods, later evolving to require no user interaction, compromising devices via malformed messages.

Despite facing legitimacy crises post-2021 due to investigative journalism and NGO exposés, CSVs adapted by rebranding, forming opaque subsidiaries, and employing intermediaries to circumvent export controls.

Infection Chains and Technical Vectors

Commercial spyware infection chains typically start with reconnaissance to profile target devices. Operators employ one-click or zero-click vectors, exploiting vulnerabilities in messaging apps or protocols. Physical access remains an option through USB tools or forensic devices.

Once installed, implants communicate with C2 servers, often through typosquatted or compromised legitimate domains via HTTPS and SSH channels. Network traffic analysis tools and forensic kits can sometimes detect these exploits, though sophisticated implants use advanced evasion techniques.

The report emphasizes that despite regulatory efforts, the CSV market remains lucrative, with activation fees rising significantly, driving demand among nations with limited oversight. Security measures such as regular updates and cautious link handling offer partial protection.

The report calls for stronger international frameworks to regulate the sale of commercial spyware and mitigate the associated surveillance risks.

Based on reporting by GBHackers.