New campaigns featuring FinFisher are underway with new infection enablers: internet service providers (ISPs), researchers at ESET warned. FinFisher, sometimes called FinSpy, is a well-known spyware program that has been used by nation-states to spy on citizens.

Spying Automatically via ISPs

FinFisher is a tool specifically designed to have the stealthy spy capabilities that George Orwell might understand. According to ESET’s blog, We Live Security, the spyware can perform live subject surveillance through the use of a computer’s webcam and microphone, keylogging of typed input and exfiltration of files. While FinFisher has been marketed as a way for authorities to monitor the bad guys, certain regimes have used it to gather information about people of interest to them.

ESET said that its security experts found FinFisher variants present in seven countries. It did not say in which countries they were found, however.

Along with this, the researchers were alarmed to see that a previously undetected method was used for infection in two of these countries: a man-in-the-middle (MitM) attack that involved ISPs. If a specific user requests certain apps — typically WhatsApp, Skype, Avast, WinRAR and VLC Player — the link request is replaced with an HTTP 307 Temporary Redirect status response code.

Replacing the normal link with a malicious one is something that would be relatively simple for an ISP to do if it was given a list of targets by authorities. The use of an HTTP 307 call is also invisible to the user, making it difficult to detect.

Suspicious Similarities

SecurityWeek recalled that leaked documents regarding Finfisher’s initial purveyor, Gamma Group, showed the existence of a tool called FinFly ISP that was designed for deployment on ISP networks. This tool had the ability to perform these kinds of MitM attacks.

ESET further noted that all of the affected targets in this campaign that were within a particular country were found to use the same ISP. Not only that, but the same redirection method and format had been previously used by other ISPs to modify internet content in at least one of the countries involved in this attack.

Using ISPs to infect and spy on users has never been revealed until now. These kinds of campaigns would represent what ESET called a “sophisticated and stealthy surveillance project unprecedented in its combination of methods and reach.”

More from

The importance of Infrastructure as Code (IaC) when Securing cloud environments

4 min read - According to the 2023 Thales Data Threat Report, 55% of organizations experiencing a data breach have reported “human error” as the primary cause. This is further compounded by organizations now facing attacks from increasingly sophisticated cyber criminals with a wide range of automated tools. As organizations move more of their operations to the cloud, they must also become increasingly aware of the security risks and threats that come with it. It’s not enough anymore to simply have a set of…

Data never dies: The immortal battle of data privacy

4 min read - More than two hundred years ago, Benjamin Franklin said there is nothing certain but death and taxes. If Franklin were alive today, he would add one more certainty to his list: your digital profile. Between the data compiled and stored by employers, private businesses, government agencies and social media sites, the personal information of nearly every single individual is anywhere and everywhere. When someone dies, that data becomes the responsibility of the estate; but what happens to the privacy rights…

Vulnerability resolution enhanced by integrations

2 min read - Why speed is of the essence in today's cybersecurity landscape? How are you quickly achieving vulnerability resolution? Identifying vulnerabilities should be part of the daily process within an organization. It's an important piece of maintaining an organization’s security posture. However, the complicated nature of modern technologies — and the pace of change — often make vulnerability management a challenging task. In the past, many organizations had to support manual integration work to get different security systems to ‘talk’ to each…

How I got started: SIEM engineer

3 min read - As careers in cybersecurity become increasingly more specialized, Security Information and Event Management (SIEM) engineers are playing a more prominent role. These professionals are like forensic specialists but are also on the front lines protecting sensitive information from the relentless onslaught of cyber threats. SIEM engineers meticulously monitor, analyze and manage security events and incidents within an organization. They leverage SIEM tools to aggregate and correlate data, enabling them to detect anomalies, identify potential threats and respond swiftly to security…