Italian spyware manufacturer SIO has been identified as the developer behind a malicious Android application, dubbed Spyrtacus, that is disguised as popular services like WhatsApp and designed to steal private data from targeted devices.
A security researcher provided TechCrunch with three Android apps suspected of being government spyware. Upon analysis, both Google and Lookout security firm confirmed these apps were indeed surveillance tools, identifying it as Spyrtacus, a sophisticated spyware program capable of exfiltrating text messages, chat data from messaging platforms like WhatsApp, Signal, and Facebook Messenger, contact lists, and even recording audio and imagery via the device’s microphone and camera.
The spyware’s distribution is highly targeted, with the apps and associated websites presented in Italian, suggesting use by domestic law enforcement. However, it remains unclear who the victims of this campaign are.
Google has assured that no known Spyrtacus-infected apps exist on the Play Store and that Android has included protections against this malware since 2022. However, last year, Kaspersky reported that earlier versions of Spyrtacus were once distributed through Google Play before shifting to malicious third-party sites impersonating telecom providers.
Italy houses several spyware firms, with companies like Hacking Team, Cy4Gate, eSurv, and RCS Lab producing surveillance tools used worldwide. Like previous spyware campaigns, Spyrtacus was distributed through fake apps mimicking legitimate services, including those of telecom providers TIM, Vodafone, and WINDTRE.
Lookout traced the spyware’s command-and-control infrastructure to ASIGINT, a subsidiary of SIO specialising in computer wiretapping services. Public records confirm ASIGINT’s connection to SIO, further solidifying the link between the spyware and its developers.
Additionally, researchers found Neapolitan dialect phrases embedded in Spyrtacus source code, hinting at possible development origins in southern Italy.
Just like SIO in Italy, there are several other tech firms solely devoted to producing spyware. Examples include Intellexa, Cytrox, Variston, NSO Group, Negg Group. Usually, the spyware customers include high-profile private citizens or in most cases, the government.
However, researchers are still unable to find out which government customer was behind the use of Spyrtacus.
In the News: Chinese hackers exploit Cisco devices in 100 countries including India
