🇮🇹

Hacking Team

APT Group 154 zero-day CVEs ETDA ✓

Also Known As

No alias recorded

Target Countries 9

Countries highlighted in red

Azerbaijan Belgium Bahrain China Germany United Kingdom Italy Uganda United States

Sectors Targeted

Computer Systems Design Services 541512 Employment Placement Agencies and Executive Search Services 56131 National Security and International Affairs 9281 Newspaper Publishers 51111 Business, Professional, Labor, Political, and Similar Organizations 8139 Public Administration 92 Computer Systems Design and Related Services 54151 Human Resources Consulting Services 541612 Finance and Insurance 52 Oil and Gas Extraction 211 Justice, Public Order, and Safety Activities 9221 Offices of Physicians 6211 Aerospace Product and Parts Manufacturing 3364 Construction 23

Details

Origin 🇮🇹 IT

Last Updated 01 Jun 2022

Malware Families 1

rcs

MITRE ATT&CK 20

T1055.003 T1059 T1059.003 T1060 T1068 T1070 T1071 T1078 T1083 T1087 T1105 T1135 T1203 T1218 T1498.001 T1499.004 T1550.002 T1558 T1564.001 T1566.002

Related Zero-Days 154

CVE-2015-5122 CVE-2017-0144 CVE-2018-0802 CVE-2019-0708 CVE-2019-3568 CVE-2020-1472 CVE-2021-1675 CVE-2021-26829 CVE-2021-26855 CVE-2021-26857 CVE-2021-26858 CVE-2021-27065 CVE-2021-34527 CVE-2021-36942 CVE-2021-40449 CVE-2021-40539 CVE-2021-42321 CVE-2021-44228 CVE-2022-24521 CVE-2022-26134 CVE-2022-3236 CVE-2022-41040 CVE-2022-41073 CVE-2022-41082 CVE-2022-42475 CVE-2023-20198 CVE-2023-22515 CVE-2023-23376 CVE-2023-23397 CVE-2023-28252 CVE-2023-2868 CVE-2023-34048 CVE-2023-35708 CVE-2023-38831 CVE-2023-41993 CVE-2023-46604 CVE-2023-46805 CVE-2023-52163 CVE-2024-0012 CVE-2024-1086 CVE-2024-12356 CVE-2024-20399 CVE-2024-21287 CVE-2024-21887 CVE-2024-24919 CVE-2024-3400 CVE-2024-38193 CVE-2024-38213 CVE-2024-38657 CVE-2024-39717 CVE-2024-43093 CVE-2024-4671 CVE-2024-47575 CVE-2024-49039 CVE-2024-49138 CVE-2024-4947 CVE-2024-50302 CVE-2024-50387 CVE-2024-50388 CVE-2024-50623 CVE-2024-5274 CVE-2024-53104 CVE-2024-53150 CVE-2024-53197 CVE-2024-55591 CVE-2024-8068 CVE-2024-8190 CVE-2024-8963 CVE-2024-9380 CVE-2024-9680 CVE-2025-0282 CVE-2025-0283 CVE-2025-0411 CVE-2025-0994 CVE-2025-10035 CVE-2025-10585 CVE-2025-11371 CVE-2025-11837 CVE-2025-1316 CVE-2025-13223 CVE-2025-14174 CVE-2025-14733 CVE-2025-20333 CVE-2025-20337 CVE-2025-20352 CVE-2025-20362 CVE-2025-20363 CVE-2025-21043 CVE-2025-21391 CVE-2025-21418 CVE-2025-22224 CVE-2025-22225 CVE-2025-22226 CVE-2025-22457 CVE-2025-24085 CVE-2025-24200 CVE-2025-24201 CVE-2025-24893 CVE-2025-24983 CVE-2025-24984 CVE-2025-24985 CVE-2025-24991 CVE-2025-24993 CVE-2025-25256 CVE-2025-26633 CVE-2025-27363 CVE-2025-2775 CVE-2025-2783 CVE-2025-29824 CVE-2025-31200 CVE-2025-31201 CVE-2025-33053 CVE-2025-37164 CVE-2025-38352 CVE-2025-41236 CVE-2025-41237 CVE-2025-41238 CVE-2025-41239 CVE-2025-41244 CVE-2025-43200 CVE-2025-43300 CVE-2025-43529 CVE-2025-4427 CVE-2025-4428 CVE-2025-4664 CVE-2025-49704 CVE-2025-52425 CVE-2025-53770 CVE-2025-53771 CVE-2025-5419 CVE-2025-54309 CVE-2025-54948 CVE-2025-54987 CVE-2025-55177 CVE-2025-55182 CVE-2025-58034 CVE-2025-59287 CVE-2025-59389 CVE-2025-61757 CVE-2025-61882 CVE-2025-6218 CVE-2025-62215 CVE-2025-62847 CVE-2025-62848 CVE-2025-62849 CVE-2025-6389 CVE-2025-6554 CVE-2025-6558 CVE-2025-7775 CVE-2025-8088 CVE-2025-8110 CVE-2025-8424 CVE-2025-9242 CVE-2025-9491

Known Names 1 entries

Hacking Team real name

Description

The many 0-days that had been collected by Hacking Team and which became publicly available during the breach of their organization in 2015, have been used by several APT groups since. (ESET) Since being founded in 2003, the Italian spyware vendor Hacking Team gained notoriety for selling surveillance tools to governments and their agencies across the world. The capabilities of its flagship product, the Remote Control System (RCS), include extracting files from a targeted device, intercepting emails and instant messaging, as well as remotely activating a device’s webcam and microphone. The company has been criticized for selling these capabilities to authoritarian governments – an allegation it has consistently denied. When the tables turned in July 2015, with Hacking Team itself suffering a damaging hack, the reported use of RCS by oppressive regimes was confirmed. With 400GB of internal data – including the once-secret list of customers, internal communications, and spyware source code – leaked online, Hacking Team was forced to request its customers to suspend all use of RCS, and was left facing an uncertain future. Following the hack, the security community has been keeping a close eye on the company’s efforts to get back on its feet. The first reports suggesting Hacking Team’s resumed operations came six months later – a new sample of Hacking Team’s Mac spyware was apparently in the wild. A year after the breach, an investment by a company named Tablem Limited brought changes to Hacking Team’s shareholder structure, with Tablem Limited taking 20% of Hacking Team’s shareholding. Tablem Limited is officially based in Cyprus; however, recent news suggests it has ties to Saudi Arabia.

Reports & References 3

https://www.welivesecurity.com/2018/03/09/new-traces-hacking-team-wild/ https://en.wikipedia.org/wiki/Hacking_Team https://www.vice.com/en_us/article/gvye3m/spy-tech-company-hacking-team-gets-hacked

ETDA Profile

Hacking Team

Origin

Italy

First Seen 2003

Motivation

Financial gain

View on ETDA APT Groups ↗