Key Takeaways
- Landfall spyware targeted Samsung Galaxy phones using a zero-day vulnerability.
- The attack likely focused on individuals in the Middle East.
- Samsung patched the vulnerability in April 2025.
- The spyware shares infrastructure with known surveillance vendor Stealth Falcon.
Discovery of Landfall Spyware
Security researchers at Palo Alto Networks’ Unit 42 uncovered a sophisticated Android spyware campaign targeting Samsung Galaxy phones. The spyware, named “Landfall,” was first detected in July 2024. It exploited a previously unknown security flaw in Galaxy phone software, known as a zero-day vulnerability.
Exploitation Method
The Landfall spyware could infiltrate devices by sending a malicious image to a victim’s phone, likely via a messaging app. Importantly, the attack might not have required any interaction from the victim. Samsung addressed this flaw, tracked as CVE-2025-21042, with a security patch in April 2025.
Targeted Espionage Campaign
Unit 42’s research suggests that the Landfall attacks were precision-targeted, focusing on individuals rather than deploying mass-distributed malware. This indicates a likely espionage motive, with potential targets located in the Middle East.
Connection to Stealth Falcon
The digital infrastructure used by Landfall overlaps with that of Stealth Falcon, a known surveillance vendor. Stealth Falcon has been implicated in past spyware attacks on Emirati journalists and activists. However, the connection is not definitive enough to attribute the attacks to a specific government.
Affected Devices and Regions
The spyware’s source code referenced several Galaxy models, including the Galaxy S22, S23, S24, and some Z models. It affected Android versions 13 through 15. Samples of the spyware were uploaded to VirusTotal from Morocco, Iran, Iraq, and Turkey. Turkey’s national cyber readiness team flagged an IP address linked to the spyware as malicious, supporting the theory of targeted individuals in Turkey.
FAQ
What is a zero-day vulnerability?
A zero-day vulnerability is a security flaw in software that is unknown to the software vendor. It can be exploited by attackers before the vendor is aware and able to patch it.
Which Samsung devices were targeted by Landfall?
The spyware targeted several Galaxy models, including the Galaxy S22, S23, S24, and some Z models.
Has the vulnerability been fixed?
Yes, Samsung patched the vulnerability in April 2025.
Summary
The Landfall spyware campaign highlights the risks posed by zero-day vulnerabilities and targeted espionage attacks. Businesses running their own software systems should prioritize regular security audits and updates to mitigate similar threats effectively.
Source: ‘Landfall’ spyware abused zero-day to hack Samsung Galaxy phones – techcrunch.com