Google details the commercial spyware Hermit, used in Kazakhstan and Italy, targeting Android and iOS; the iOS version has six exploits, including two zero-days
Context & Ripple Effects
Hermit emerged alongside reports of Predator spyware campaigns exploiting Android vulnerabilities, placing it within a documented commercial-surveillance market rather than an isolated mobile threat. Google's later account of highly targeted spyware campaigns against Android, iOS, and Chrome reinforces that cross-platform zero-day use persisted beyond this disclosure.
First-order effects
- Hermit's operators lose secrecy around a toolset used against Android and iOS targets in Kazakhstan and Italy, while affected defenders can concentrate on the six identified iOS exploits, including two zero-days.
- Google's public attribution of the malware raises the security burden for both mobile ecosystems because the same campaign spans Android and iOS.
Second-order effects
- Commercial spyware vendors face a shorter usable life for exploit chains once researchers disclose their platform coverage and targeting patterns.
- Google and Apple are pushed toward faster detection and remediation for targeted attacks, not only broad consumer malware, as subsequent reporting documented similar multi-platform campaigns.
Third-order effects
- The pattern points to commercial spyware becoming a durable source of high-end zero-day abuse across major client platforms; Google's later 2025 zero-day accounting identifies such vendors among the leading sources of exploitation.
- Mobile security competition increasingly turns on the ability to identify narrowly targeted campaigns before exploit chains can be reused across operating systems.
The trend: Commercial spyware providers are increasingly treating Android and iOS as parallel targets, making zero-day defense and threat-intelligence disclosure central to mobile platform security.
Related: Hermit · Android · Google details Predator spyware campaigns · Google details targeted spyware campaigns · Google's 2025 zero-day exploitation report
Related Coverage
- Spyware vendor targets users in Italy and Kazakhstan The Keyword · Benoit Sevens
- The curious tale of a fake Carrier.app Project Zero · Ian Beer
- Apple and Android phones hacked by Italian spyware, Google says Reuters · Zeba Siddiqui
- Google details commercial spyware that targets both Android and iOS devices ZDNet · Charlie Osborne
- Google Warns Spyware Being Deployed Against Android, iOS Users Threatpost · Elizabeth Montalbano
- Google: How we tackled this iPhone, Android spyware The Register · Jessica Lyons Hardcastle
- Google TAG argues surveillance firm RCS Labs was helped by ISPs to infect mobile users Security Affairs · Pierluigi Paganini
- Spyware vendor works with ISPs to infect iOS and Android users BleepingComputer · Sergiu Gatlan
- Spyware Made For “Lawful Interception” Used To Target Android, iOS Users Android Headlines · Sumit Adhikari
- Hermit spyware is dangerous for Android and iOS: Google Huawei Central · Shang Pemely
- Why you don't need to worry about the recent Italian iPhone hacker attack Macworld · Roman Loyola
- Spyware Vendors Hawking Zero-Day Flaws Uncovered by Google Bloomberg · Jack Gillum
- Attackers hit iOS and Android devices with spyware in Italy and Kazakhstan AppleInsider · Darryl Boxberger
- Google reveals sophisticated Italian spyware campaign targeting victims in Italy, Kazakhstan CyberScoop · AJ Vicens
Discussion
-
@rondeibert
@rondeibert
on x
Your weekly reminder that there are more spyware vendors active in the mercenary marketplace than just NSO: Apple and Android phones hacked by Italian spyware, @billyleonard of @Google says: https://www.reuters.com/...
-
@i41nbeer
Ian Beer
on x
Excited to publish my writeup of a novel iOS in-the-wild exploit: The curious case of the fake Carrier .app: https://googleprojectzero.blogspot.com/ ...
-
@jsrailton
John Scott-Railton
on x
NEW: meet Italian mercenary spyware vendor RCS Labs. Victims in: 🇮🇹Italy 🇰🇿Kazakhstan. One clever technique: cut victims data w/ISP complicity, then prompt them to load malicious app to ‘reconnect.’ 1/ By @benoitsevens & Clement Lecigne h/t @maddiestone https://blog.google/... ht…
-
@marcan42
Hector Martin
on x
The Project Zero blogpost is wrong about this detail. DCP only needs to access a few register blocks, for which it uses a terribly-designed API that lets it specify the physical memory address to map. We knew it was dumb, so we implemented an allowlist. Apparently Apple didn't. h…
-
@z3r0trust
@z3r0trust
on x
“TAG says it currently tracks more than 30 spyware makers that offer an array of technical capabilities and levels of sophistication to government-backed clients.” Google Warns of New Spyware Targeting iOS and Android Users https://www.wired.com/... via @wired
-
@marcan42
Hector Martin
on x
Apple intends for coprocessors not to be able to pwn the system and vice versa, so there are two, possibly three vulnerabilities here: - The DCP vuln allowing the AP to take over - The DCP driver vuln allowing DCP to take over - Apple exposing DCP directly to userspace
-
@evacide
Eva
on x
Even if NSO Group dies, it is part of a whole ecosystem of companies that make and sell spyware to governments. TAG's latest report highlights the work of Milan-based RCS Lab, which used to be a Hacking Team reseller. https://twitter.com/...
-
@alyssarzg
Alyssa Rosenzweig
on x
I don't want to toot my own horn. All software has bugs. Both Linux and iOS have 0-days. But some software architectures eliminate entire classes of bugs, and maybe one of those classes is “userspace attacks a coprocessor and the coprocessor can pwn the kernel”.
-
@marcan42
Hector Martin
on x
TL;DR the DCP firmware interface design is insane, and none of this surprises me given what Apple did here. Thankfully, in exchange for having to deal with the AP side of the insanity from scratch, we also get to implement it properly from the get-go.
-
@marcan42
Hector Martin
on x
Ha, a DCP-based exploit that jumps from userspace to DCP and back to the kernel. Cute. Remember what I said about M1 coprocessors not being able to pwn the system? That's assuming your driver doesn't implement “sudo pwn the system” like Apple's does 😅. https://googleprojectzero.b…
-
@alyssarzg
Alyssa Rosenzweig
on x
I did not expect to find myself linked from a Project Zero write-up. Fascinating read about a seriously weird iOS 0-day. https://googleprojectzero.blogspot.com/ ...
-
@jsrailton
John Scott-Railton
on x
2/ The inevitable question is “how does RCS Labs compare to...” Two datapoints: - This isn't zero click, this is a bunch of clicks & requires some user convincing - Look at these stale milk exploits... Yet obviously...it still works well enough that folks are paying for it. https…
-
@campuscodi
Catalin Cimpanu
on x
Today, following on Lookout's report last week, Google TAG has published its own insight on the activities of Italian spyware vendor RCS Lab https://blog.google/... https://twitter.com/...
-
@campuscodi
Catalin Cimpanu
on x
The Project Zero team also has a report on CVE-2021-30983, a novel iOS zero-day exploit abused by the company's tools (which also included tons of other exploits, see image) https://googleprojectzero.blogspot.com/ ... https://twitter.com/...
-
@jsrailton
John Scott-Railton
on x
4/ There is also an abuse scandal involving RCS Labs, within 🇮🇹Italy. Yet another reminder that the 🇪🇺EU has a festering mercenary spyware problem. https://twitter.com/...
-
@jsrailton
John Scott-Railton
on x
3/ @Lookout recently published a detailed investigation into RCS Lab, which has been a reseller for Hacking Team. Lookout does a nice job of highlighting the sketchy regimes they deal with. Recommended read: https://www.lookout.com/... https://twitter.com/...
-
@zackwhittaker
Zack Whittaker
on x
Google said Hermit's iOS spyware app used a zero-day flaw which was known at the time of discovery to be actively exploited. Hermit used Apple enterprise developer certificates to bypass the App Store, which Apple says it has now revoked. https://techcrunch.com/...
-
@ryanaraine
Ryan Naraine
on x
“A memory-corruption-based privilege escalation that side-stepped kernel mitigations by corrupting memory on a co-processor instead...” GPZ research https://googleprojectzero.blogspot.com/ ...
-
@zackwhittaker
Zack Whittaker
on x
This follows Lookout's research into Hermit (https://t.co/...) which first attributed the spyware to RCS Lab. Google now has more details on the iOS version of the spyware, which abuses enterprise certificates to sideload outside of the app store. https://blog.google/...
-
@kaylintrychon
Kaylin Trychon
on x
Love me a little @Google Project Zero & TAG collabo.. New research out today about Italian spyware vendor, RCS Labs, capabilities and targeting of users in Italy & Kazakhstan. https://blog.google/...
-
@howelloneill
Patrick Howell O'Neill
on x
“We assess, based on the extensive body of research and analysis by TAG and Project Zero, that the commercial spyware industry is thriving and growing at a significant rate.” https://blog.google/...
-
@itswillis
Tim Willis
on x
Nice to see a “short” 25-pager from @i41nbeer on a novel iOS exploit found in the wild. While both @Lookout and Google TAG weren't able to capture the exploits used for the Android version, a reminder that if you've found Android in the wild 0-day, we'd love to write about it! ht…
-
@i41nbeer
Ian Beer
on x
Check out Google's Threat Analysis Group's post which has more operational details: https://blog.google/...
-
@zackwhittaker
Zack Whittaker
on x
New: Google is notifying Android users whose devices have been compromised by Hermit, a government-grade spyware used against victims in Italy and Kazakhstan. https://techcrunch.com/...