Glossary term
Zero-day vulnerability
A zero-day vulnerability is a weakness in hardware, firmware or software that was previously unknown.
Read more
Significant cyber incident
Predator spyware attempts against an Egyptian opposition candidate, 2023
The Predator spyware attempts against an Egyptian opposition candidate in 2023 targeted a leading figure who planned to run for president, according to reports of 23 and 24 September 2023.
In short
The Predator spyware attempts against an Egyptian opposition candidate in 2023 targeted a leading figure who planned to run for president, according to reports of 23 and 24 September 2023. The attempts ran from May to September and included an iPhone zero-day chain delivered through the Vodafone Egypt network. Apple released fixes on 21 September 2023. Citizen Lab said it had high confidence the Egyptian government was responsible.
What happened
On 23 and 24 September 2023 the Washington Post and Al Jazeera reported that an opposition figure, a journalist and former member of parliament who had announced in March 2023 that he would challenge President el-Sisi in the 2024 election, was targeted with the Predator spyware. The case was first reported by the Egyptian news outlet Mada Masr.
He became worried in mid-September after receiving suspicious messages with links and asked Citizen Lab, a research group at the University of Toronto, to examine his phone. Researchers from Citizen Lab and Google found the malware. According to Citizen Lab, attempts started in May 2023 with links sent by text message and WhatsApp. From August he was hit by a more dangerous method: when he opened an ordinary web page without HTTPS, he was redirected to a server that tried to infect his iPhone. The attempts probably failed because he had turned on Apple’s Lockdown Mode.
The exploit was a zero-day chain, which means the flaws were unknown to Apple. Apple released fixes on 21 September 2023, and CISA added the three flaws to its list of exploited vulnerabilities on 25 September 2023. Citizen Lab said it had high confidence that the Egyptian government was responsible. Government representatives declined to comment or did not respond to the Washington Post.
Citizen Lab had already found in 2021 that the same man was hacked with Predator.
Timeline
-
2021
Citizen Lab determines that he was hacked with Predator earlier, according to Al Jazeera.
-
March 2023
He announces his bid to challenge President el-Sisi in the 2024 election.
-
May 2023
Attempts begin with links sent by text message and WhatsApp that he would have to click.
-
July 2023
The US Commerce Department puts Cytrox and Intellexa on its entity list, as the Washington Post reports.
-
August 2023
Network injection attempts begin on his Vodafone Egypt connection. They do not need a click.
-
Mid-September 2023
He becomes worried after suspicious messages with links and contacts Citizen Lab.
-
21 September 2023
Apple releases iOS 16.7 with fixes for the flaws, after Citizen Lab and Google report them.
-
23 September 2023
The Washington Post reports the case; he speaks publicly.
-
24 September 2023
Al Jazeera reports that researchers believe the Egyptian government is behind the attacks.
-
25 September 2023
CISA adds the three Apple flaws to its Known Exploited Vulnerabilities Catalog.
How the attack worked
The sources describe two waves of attempts against one iPhone. Both aimed to install Predator, a spyware made by Cytrox that, once installed, can steal passwords, log keystrokes, copy chat messages and record calls, as the Washington Post puts it.
Wave one: links
From May 2023 he received text and WhatsApp messages with links to booby-trapped web pages. He evidently did not click on them, according to the researchers quoted by the Washington Post.
Wave two: network injection
From August 2023 the attackers used a man-in-the-middle method. Al Jazeera says his connection to the Vodafone Egypt network was configured to infect his phone automatically if he visited a site that did not use HTTPS. The Washington Post, citing Google’s researchers, says that when he opened any page starting with http, he was redirected to an Intellexa website and then to a server that ran the exploit. A Citizen Lab researcher told Al Jazeera that the government could select anyone on the network in this way. Citizen Lab said the infection did not need a click, and that the delivery came from a device inside Egypt.
The exploit
The chain used three Apple flaws. CISA lists them as CVE-2023-41991 (improper certificate validation), CVE-2023-41992 (kernel privilege escalation) and CVE-2023-41993 (WebKit code execution). The Washington Post says it was a zero-day chain built to infect even fully updated iPhones.
Why it failed
Citizen Lab said the attempts probably failed because he had Lockdown Mode switched on. Apple recommends that mode for users at high risk.
- Texts and WhatsApp linksBooby-trapped links were sent from May 2023; no click is known
- Network injectionHis Vodafone Egypt connection redirected plain http pages to an attack server from August 2023
- Zero-day exploit chainThree Apple flaws were used to install Predator on up-to-date iPhones
- If installedPredator can steal passwords, log keystrokes and record calls
- BlockedThe attempt probably failed because Lockdown Mode was on
Who says who was behind it
Attributed by Citizen Lab to the Egyptian government, with "high confidence" (Washington Post, 23 September 2023). Al Jazeera (24 September 2023) says the researchers are certain. The reason given: Egypt is a known customer of Predator's maker Cytrox, and the spyware was delivered by network injection from Egyptian soil. The Washington Post adds that one infection attempt was made by a device physically located inside Egypt. Egyptian government representatives declined to comment or did not respond. The wording differs between outlets (certain, high confidence); both describe the same finding.
Impact
The sources say the infection attempts probably failed because Lockdown Mode was on, so no successful infection is reported in the pages opened. The impact is therefore the targeting itself: repeated attempts over about five months against a declared presidential candidate, and a zero-day chain that put every unpatched iPhone at risk until Apple's update of 21 September 2023. CISA lists the three flaws as exploited. The sources give no number of other victims. The man himself said he saw the attempts as linked to his candidacy and opposition role.
Government and regulator response
- Victim: he contacted Citizen Lab in mid-September 2023 and spoke publicly on 23 September 2023.
- Researchers: Citizen Lab and Google reported the flaws to Apple.
- Apple: released iOS 16.7 on 21 September 2023 and said it was aware of a report of active exploitation.
- CISA: added CVE-2023-41991, CVE-2023-41992 and CVE-2023-41993 to the Known Exploited Vulnerabilities Catalog on 25 September 2023. Federal civilian agencies must fix listed flaws by the due date. CISA urged all organizations to prioritize catalog fixes.
- US Commerce Department: had already put Cytrox and Intellexa on its entity list in July 2023 (as reported by the Washington Post).
- Egypt: government representatives declined to comment or did not respond.
Lessons
-
Patch phones as fast as laptops
A fully updated iPhone was the target of a zero-day chain, and Apple's fix came only after researchers found it. Apply mobile updates the day they ship.
-
Use the strongest mode for people at risk
Citizen Lab said Lockdown Mode probably made the attempts fail. Turn it on for politicians, journalists, executives and others who are likely targets.
-
No click is needed
The network injection did not require him to click. Do not rely on training people to avoid links as the only defense for high-risk staff.
-
Use HTTPS everywhere
The injection worked on pages without HTTPS. Browsers and sites that enforce HTTPS shrink this attack surface.
-
Know that the network can be an attacker
Researchers said the government could pick any user on the carrier's network. For high-risk staff, treat the local mobile network as untrusted.
-
Give high-risk staff a place to report
He asked a research group for help after suspicious messages. Give staff a clear contact for reporting odd texts.
What to check in your own organization
-
iOS version
Check that every managed iPhone runs iOS 16.7 or later, and in practice the latest release, and report devices that lag.
-
Lockdown Mode
List staff at high risk and check whether Lockdown Mode is switched on for them.
-
CISA catalog
Compare your software list with the Known Exploited Vulnerabilities Catalog each week, as CISA urges.
-
HTTPS only
Check that your own sites force HTTPS and that high-risk staff use browsers that warn on plain http.
-
Suspicious message route
Check that staff know who to forward suspicious texts and WhatsApp messages to.
-
Mobile device management
Check that you can see OS versions and force updates on phones, including personal phones used for work.
-
Travel and carrier risk
For staff in high-risk countries, decide whether to use separate phones or a trusted VPN on public networks.
Where it happened
Questions
Who was targeted?
An opposition figure, a journalist and former Egyptian member of parliament who announced in March 2023 that he would run for president.
Which spyware was used?
Predator, made by Cytrox, according to the Washington Post and Al Jazeera.
Who was behind it?
Citizen Lab said it had high confidence that the Egyptian government was responsible. Egyptian government representatives declined to comment or did not respond.
Did the attack work?
The researchers quoted say the attempts probably failed because he had Lockdown Mode switched on.
Which flaws were used?
CISA lists CVE-2023-41991, CVE-2023-41992 and CVE-2023-41993. Apple fixed them in iOS 16.7 on 21 September 2023.
Is this the first time?
Al Jazeera says Citizen Lab had found in 2021 that he was hacked with Predator.
Sources
- Leading Egyptian opposition presidential candidate targeted by spyware (24 September 2023) Al Jazeera
- Egyptian presidential hopeful targeted by Predator spyware (23 September 2023, Washington Post copy) Stars and Stripes
- CISA Adds Three Known Exploited Vulnerabilities to Catalog (25 September 2023) CISA
- About the security content of iOS 16.7 and iPadOS 16.7 Apple Support
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.