![\"Zero-Day](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/11\/mobile-exploit.jpg\" "\\"Zero-Day")
<\/a><\/p>\nA now-patched security flaw in Samsung Galaxy Android devices was exploited as a zero-day to deliver a “commercial-grade” Android spyware dubbed LANDFALL in targeted attacks in the Middle East.<\/p>\n
The activity involved the exploitation of CVE-2025-21042<\/a> (CVSS score: 8.8), an out-of-bounds write flaw in the “libimagecodec.quram.so” component that could allow remote attackers to execute arbitrary code, according to Palo Alto Networks Unit 42. The issue was addressed<\/a> by Samsung in April 2025.<\/p>\n “This vulnerability was actively exploited in the wild before Samsung patched it in April 2025, following reports of in-the-wild attacks,” Unit 42 said<\/a>. Potential targets of the activity, tracked as CL-UNK-1054, are located in Iraq, Iran, Turkey, and Morocco based on VirusTotal submission data.<\/p>\n The development comes as Samsung disclosed<\/a> in September 2025 that another flaw in the same library (CVE-2025-21043, CVSS score: 8.8) had also been exploited in the wild as a zero-day. There is no evidence of this security flaw being weaponized in the LANDFALL campaign. Samsung did not immediately respond to a request for comment.<\/p>\n It’s assessed that the attacks involved sending via WhatsApp malicious images in the form of DNG<\/a> (Digital Negative) files, with evidence of LANDFALL samples going all the way back to July 23, 2024. This is based on DNG artifacts bearing names like “WhatsApp Image 2025-02-10 at 4.54.17 PM.jpeg” and “IMG-20240723-WA0000.jpg.”<\/p>\n LANDFALL, once installed and executed, acts as a comprehensive spy tool, capable of harvesting sensitive data, including microphone recording, location, photos, contacts, SMS, files, and call logs.<\/p>\n While Unit 42 said the exploit chain may have involved the use of a zero-click approach to trigger the exploitation of CVE-2025-21042 without requiring any user interaction, there are currently no indications that it has happened or there exists an unknown security issue in WhatsApp to support this hypothesis.<\/p>\n The Android spyware is specifically designed to target Samsung’s Galaxy S22, S23, and S24 series devices, as well as Z Fold 4 and Z Flip 4, covering some of the flagship devices from the South Korean electronics chaebol, with the exception of the latest generation.<\/p>\n It’s worth noting that around the same time WhatsApp disclosed that a flaw in its messaging app for iOS and macOS (CVE-2025-55177<\/a>, CVSS score: 5.4) was chained along with CVE-2025-43300<\/a> (CVSS score: 8.8), a flaw in Apple iOS, iPadOS, and macOS, to potentially target less than 200 users as part of a sophisticated campaign. Apple and WhatsApp have since patched the flaws.<\/p>\n Unit 42’s analysis of the discovered DNG files show that they come with an embedded ZIP file appended to the end of the file, with the exploit being used to extract a shared object library from the archive to run the spyware. Also present in the archive is another shared object that’s designed to manipulate the device’s SELinux<\/a> policy to grant LANDFALL elevated permissions and facilitate persistence.<\/p>\n<\/a><\/p>\n<\/a>Flowchart for LANDFALL spyware<\/p>\n<\/a>Timeline for recent malicious DNG image files and associated exploit activity<\/p>\n