US EditionCommercial Spyware “Landfall” Ran Rampant on Samsung Phones for Almost a Year
Landfall spyware exploited a zero-day flaw in Samsung Galaxy phones to conduct targeted surveillance in the Middle East over nearly a year, researchers said.
- On Friday, Palo Alto Networks Unit 42 revealed LandFall, a spyware targeting Samsung Galaxy devices in the Middle East that was active since at least July 2024 before being patched this year.
- Researchers found the campaign abused CVE-2025-21042, a critical out-of-bounds write in libimagecodec.quram.so triggered by malicious DNG image files, enabling zero-click infection via WhatsApp since July 23, 2024.
- Unit 42's analysis shows LandFall targets five Galaxy models including Galaxy S22, S23, S24, Z Fold 4 and Z Flip 4, embedding a loader and SELinux policy manipulator while using six command-and-control servers.
- Unit 42 cautioned that although Landfall shares infrastructure similarities with Stealth Falcon, attribution remains unclear as `The technical overlaps are intriguing but not strong enough for responsible attribution`, Cohen said, and researchers urged users to install this year's patch due to removal difficulty.
- Related patches and advisories show that Unit 42 noted LandFall's DNG-image technique echoes broader DNG image-parsing exploitation observed in recent commercial spyware operations, with similarities to activity in August and September, Cohen said.
13 Articles
13 Articles
New Landfall spyware apparently targeting Samsung phones in Middle East
A new commercial-grade spyware has apparently been targeting Samsung Galaxy phones in the Middle East, but it’s not clear who’s behind it, researchers said in a blog post Friday. Whoever’s responsible, they seized upon a previously unknown, unpatched vulnerability known as a zero-day — a flaw Samsung has since closed, the researchers from Palo Alto Networks’ Unit 42 said. The company dubbed the spyware “Landfall.” The research indicates potentia…
LANDFALL Spyware Exploited Samsung Zero-day CVE-2025-21042 In Middle East Attacks - Cybernoz - Cybersecurity News
LANDFALL spyware exploited Samsung zero-day CVE-2025-21042 in Middle East attacks Pierluigi Paganini November 07, 2025 A now-patched Samsung Galaxy flaw, tracked as CVE-2025-21042, was exploited as a zero-day to deploy LANDFALL spyware in targeted attacks in Middle East. Samsung patched a flaw exploited as a zero-day, tracked as CVE-2025-21042 (CVSS score of 8.8), to deploy LANDFALL spyware on Galaxy devices in Middle East attack…
Coverage Details
Bias Distribution
- 100% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
