Threat video1:00
Predator, Pegasus, Graphite Spyware: Detection & IOCs
Predator, Pegasus and Graphite spyware hit European journalists and politicians: 26 IOCs and 9 detection rules, including a free Splunk SPL rule.
Read the full threat intel for Predator, Pegasus, Graphite Spyware: Detection & IOCs →
Chapters
- 0:00The hookThree spyware families hit journalists.
- 0:04The storyAthens convicted four Intellexa-linked people.
- 0:11Attack pathRandom English domains sent fake lures.
- 0:24AttributionAttributed to Intellexa Consortium.
- 0:30Indicators of compromise18 indicators to hunt: 5 IPs, 11 domains and 2 file names.
- 0:36MITRE ATT&CK techniques13 ATT&CK techniques, from resource development to exfiltration.
- 0:42Remediation5 steps now: Enable iOS Lockdown Mode for journalists, activists, opposition politicians.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Three spyware families hit journalists.
0:05Athens convicted four Intellexa-linked people.
0:08The orderer remains unidentified.
0:11Random English domains sent fake lures.
0:14Some routes needed no click.
0:16Then spyware read messages, contacts and documents.
0:19It can activate microphone and camera.
0:25Attributed to Intellexa Consortium. Confidence: medium.
0:3018 indicators to hunt: 5 IPs, 11 domains and 2 file names.
0:3713 ATT&CK techniques, from resource development to exfiltration.
0:425 steps now: Enable iOS Lockdown Mode for journalists, activists, opposition politicians.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.