Emerging Threats in North America's Offensive Cyber Market: Mercenary Spyware and Exploit Brokers

Introduction

The offensive cyber market in North America has seen significant growth, with a notable increase in the availability and sophistication of mercenary spyware, exploit brokers, and commercial offensive tools. These developments have introduced new challenges for cybersecurity professionals, particularly concerning ransomware groups that leverage these tools for malicious activities. This briefing provides an in-depth analysis of the current state of the offensive cyber market, focusing on the role of mercenary spyware, exploit brokers, and red team frameworks, and assesses the medium-level threat posed by ransomware groups in this context.

Mercenary Spyware and Exploit Brokers

Mercenary spyware refers to surveillance tools developed and sold by private companies to government agencies and other clients, often without sufficient oversight. These tools are designed to infiltrate devices and networks, enabling extensive monitoring and data exfiltration. Notable examples include:

• Cytrox: Established in 2017, Cytrox developed the "Predator" spyware, which has been linked to targeting politicians, journalists, and activists. In 2023, the U.S. Department of Commerce added Cytrox to its Entity List for trafficking in cyber exploits. (en.wikipedia.org)

• Candiru: Founded in 2014, Candiru provides spyware capable of exploiting zero-day vulnerabilities across various operating systems and web browsers. Their products have been used to remotely control devices, capturing data from social media, messages, and even activating cameras and microphones. (en.wikipedia.org)

Exploit brokers are entities that discover, develop, and sell zero-day vulnerabilities to the highest bidder, often without disclosing them to the affected vendors. This practice has led to the proliferation of unpatched vulnerabilities, increasing the risk of exploitation by malicious actors.

Commercial Offensive Tools and Red Team Frameworks

The availability of commercial offensive tools has democratized cyber capabilities, allowing a broader range of actors to conduct sophisticated attacks. Red team frameworks, such as MITRE Caldera, Metasploit, and Atomic Red Team, are open-source tools that emulate adversary tactics and techniques, enabling organizations to test their defenses. While these tools are primarily intended for defensive purposes, they can also be repurposed by malicious actors to conduct offensive operations.

Surveillance-as-a-Service

Surveillance-as-a-Service refers to the outsourcing of surveillance operations to third-party providers who offer comprehensive monitoring solutions. This model allows clients to conduct extensive surveillance without developing in-house capabilities, raising concerns about privacy and the potential for abuse. The use of such services by ransomware groups can enhance their operational effectiveness, enabling more targeted and persistent attacks.

Ransomware Groups and the Medium-Level Threat

Ransomware groups have increasingly adopted mercenary spyware and commercial offensive tools to enhance their operations. By leveraging these resources, they can conduct more targeted attacks, exfiltrate sensitive data, and apply pressure on victims through the threat of data release. The integration of surveillance-as-a-Service further amplifies their capabilities, allowing for continuous monitoring of victims and more effective ransom negotiations.

While the threat posed by these groups is significant, it is currently assessed as medium-level. This assessment is based on the following factors:

• Detection and Mitigation: Advancements in cybersecurity have improved the detection and mitigation of ransomware attacks, reducing the success rate of such operations.

• Regulatory Measures: Increased regulatory scrutiny and sanctions against entities involved in the development and distribution of mercenary spyware have disrupted their operations.

• Public Awareness: Heightened awareness among organizations and individuals about the risks associated with mercenary spyware and ransomware attacks has led to improved defensive measures.

Conclusion

The offensive cyber market in North America is evolving rapidly, with mercenary spyware, exploit brokers, and commercial offensive tools playing increasingly prominent roles. Ransomware groups' adoption of these resources has enhanced their capabilities, posing a medium-level threat to organizations and individuals. Continuous vigilance, investment in cybersecurity defenses, and adherence to regulatory frameworks are essential to mitigate these risks and maintain the integrity of digital infrastructures.

Highlights:

• Cytrox
• Candiru (spyware company)