Madagascar Government linked to a Predator Spyware Use
Share this:
Madagascar’s government services have apparently purchased and leveraged Predator to conduct political domestic surveillance ahead of a presidential election in November.
According to research by Sekoia, the effort was a watering hole attack: Links to download the spyware were added to WordPress blogs containing genuine articles taken from the Madagascan newspaper Midi Madagasikara. Anyone looking for the legitimate story could have ended up on the malicious page and gone on to download the spyware, according to the firm. The malicious links were obscured with URL shorteners.
Other assessments by the company showed that nations across the Middle East, Africa, and beyond have been using the Predator spyware in efforts to monitor citizens. In particular, it determined that Angola’s government services used Predator, while Kazakhstan intelligence services purchased and used the spyware too.
These findings and the alleged existence of a contract between Intellexa and Madagascar’s government for the collection and processing of interception data, previously reported by Intelligence Online, Sekoia assessed it is “plausible Madagascar government services – such as police or domestic intelligence – did purchase and leverage Cytrox’s Predator malware to conduct political domestic surveillance, months before the election.”
Sekoia said active checks of an infrastructure cluster related to the spyware found that in total, there were 121 active domain names, including in Angola, Egypt, and the Persian Gulf.
Indicators of compromise
- betly[.]me
- sec-flare[.]com
- verifyurl[.]me
High confidence
- candidaturasminfin[.]info
- grupohel[.]social
- notify-kz[.]info
- intnews[.]world
- taagangola[.]co
- afrinew[.]net
- tupuca[.]co
- newsworldsports[.]co
- newspool[.]net
- informburo[.]info
- dealstransfer[.]net
- gorlovski[.]com
- egypt-post[.]com
- podcastnow[.]club
- suarajubi[.]net
- suarajubi[.]com
- pasteposta[.]com
- post-kz[.]info
- mada[.]sahia-mijoro[.]com
- bbitly[.]com
- culniks[.]info
- folha-9[.]com
- shortly[.]work
- lttlnk[.]net
- mult[.]icaixa[.]info
- mujimbos[.]co
- leefco[.]net
- liveco[.]live
- showsme[.]info
- brkorage[.]live
- clckbck[.]com
- flowercafee[.]com
- soq[.]one
- jornaldeangola[.]info
- geloraku[.]id
- smallme[.]net
- quick-ads[.]com
- jofki[.]com
- midi-madgasikara[.]co
- flytaps[.]com
- factosdiarios[.]co
- kz-news[.]cc
- lilpastanews[.]co
- popup-pw[.]info
- eventes[.]org
- fdnews[.]info
- unitei[.]co
- businessafricaonline[.]org
- breaknews[.]live
- actualite[.]emergence-mada[.]com
- candidaturassonangol[.]info
- correiosdeangola[.]info
- 9o[.]gg
- allafrika[.]live
- visavfsglobal[.]co
- adenuncia[.]com
- portalxa[.]com
- sky-news[.]live
- vinhosadega[.]com
- shop-collect[.]com
- bestwesternt[.]com
- traffic-moi-eg[.]org
- conodeti[.]com
- gulfsports[.]info
- dw-news[.]co
- lexpressmg[.]xyz
- jakalas[.]online
- t-ready[.]me
- grvnews[.]live
- air-shopping[.]net
- gostosadeluxo[.]com
- aoatlasescort[.]com
- universedades[.]com
- bitshort[.]info
- intercontinentalhg[.]com
- clubs-k[.]com
- nm-weather[.]live
- imparcialpress[.]com
- blitzmedia[.]live
- shanam[.]org
- kz-shops[.]me
- youtub-eg[.]com
- elwatnanews[.]com
- tengrinnews[.]live
- jornalf8[.]com
- growebservice[.]com
- zoometting[.]com
- vaovao[.]soutien-a-rajoelina[.]com
- ongs[.]life
- truelocation[.]org
- ordas-kz[.]com
- glbnews[.]live
- newsreuter[.]com
- novojornal[.]co
- almasrylayoum[.]com
- dhll[.]live
- redirto[.]info
- mulherevips[.]com
- sicnoticia[.]com
- weather-live[.]com
- africa-confidentiel[.]fr
- skranski[.]com
- cnn-portugal[.]com
- wesalcity[.]net
- platinalines[.]com
- onlinewebinarmarketing[.]com
- btlin[.]life
- tclnk[.]live
- kalwaski[.]xyz
- sysnet[.]life
- clcti[.]net
- qamqors[.]net
- gorows[.]live
- moncn[.]co
- skollie[.]online
- smcu[.]me
- sysly[.]sbs
- bulk-ads[.]com
- gulfweather[.]live
- shortly[.]work
- gulfsports[.]live
Moderate to high confidence
amritacity[.]com
- awlaqf[.]sbs
- bosmata[.]com
- politi[.]live
- toomec[.]net
- crudco[.]info
- corncog[.]com
- dbtest[.]online
- espn-sports[.]live
- ftlink[.]info
- gsxr[.]me
- gulfnews[.]today
- gulfweather[.]co
- helpemail[.]net
- isalways[.]net
- isconn[.]net
- islink[.]info
- letmelook[.]one
- lnkkdis[.]xyz
- lnklit[.]com
- mg-news[.]info
- miceups[.]com
- mncnn[.]info
- mnmlink[.]co
- pklnk[.]com
- post-info[.]kz
- previeweb[.]xyz
- sexychats[.]nl
- southchinapost[.]net
- supasports[.]xyz
- syscncc[.]live
- tconn[.]net
- weatherforecast[.]services
