9 months into 2023 Google’s Threat Analysis Group has discovered 16 in-the-wild 0-days in use by commercial surveillance vendors (CSV). This is in addition to the ones found by others in the industry.
In this presentation, we’ll provide a rundown of the major players in the CSV ecosystem, the anatomy of their attacks and campaigns, and new details about some of the most recent campaigns we’ve discovered. We’ll cover both the details about how the industry functions and the details about their exploit chains and campaigns.