- A critical security flaw (CVE-2025-21042) in Samsung Galaxy Android devices enabled delivery of the LANDFALL spyware via zero-day attacks.
- The spyware was distributed through malicious WhatsApp images in Digital Negative (DNG) format, targeting users mainly in the Middle East.
- LANDFALL operates as an advanced espionage tool, extracting data such as microphone recordings, location, and contacts without user interaction.
- The flaw was patched by Samsung in April 2025, months after exploitation began.
- Analysis suggests possible connections between LANDFALL and the threat actor Stealth Falcon, though no direct links have been confirmed.
A serious security vulnerability identified as CVE-2025-21042 was exploited in zero-day attacks targeting Samsung Galaxy Android devices. This bug, found in the “libimagecodec.quram.so” component, allowed remote attackers to run arbitrary code. The attacks occurred before the flaw was fixed by Samsung in April 2025, according to Palo Alto Networks Unit 42.
The zero-day exploit delivered a sophisticated spyware named LANDFALL through malicious images sent via WhatsApp. The harmful files used the Digital Negative (DNG) format, with samples dating back to July 23, 2024. The campaign mainly targeted users located in Iraq, Iran, Turkey, and Morocco, based on submission data analyzed on VirusTotal.
Once installed, LANDFALL can perform extensive surveillance, including recording audio, tracking location, accessing photos, contacts, SMS, files, and call logs. The exploit likely employed a zero-click method, enabling automatic activation without any user interaction. The infected devices ran a shared library extracted from the DNG files, which also altered the device’s SELinux policy—a Linux-based security architecture—to escalate privileges and maintain persistence.
The spyware communicated with a command-and-control (C2) server over an encrypted HTTPS connection, allowing it to receive commands and secondary payloads. The identity of the attackers remains unknown. However, Unit 42 noted similarities between LANDFALL’s C2 infrastructure and domain registration patterns seen in Stealth Falcon, a known threat actor also called FruityArmor. So far, no direct overlaps in attack clusters have been identified.
In a related development, Samsung revealed in September 2025 another vulnerability, CVE-2025-21043, in the same library was exploited in the wild but unrelated to LANDFALL. Around the same period, security firms noted attacks involving flaws in WhatsApp and Apple operating systems, which have since been patched.
LANDFALL’s zero-day intrusion underscores the long lifespan of such exploits in public repositories before their full impact is recognized, as mentioned by Unit 42. The comprehensive nature of the spyware and the stealth of its delivery method highlight continuing risks to mobile security in targeted regions.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
Previous Articles:
- Tesla Shares Drop 4% After Musk’s $1T Pay Package Approval
- JPMorgan Ups Bitcoin ETF Stake by 64%, Adds Crypto Derivatives
- Spanish Police Arrest Crypto Pyramid Scheme Leader, €260M Fraud
- Strategy Raises $715M via Euro-Denominated Preferred Shares for BTC
- Bitcoin Falls Below $100K, Retail Sentiment Sours Amid Selloff
