Ethical Hacking News
Surveillanceware firms are raking in the cash while evading oversight and exploiting vulnerabilities for profit. The growing demand for this type of software has made it increasingly difficult to regulate, leaving targets more exposed than ever.
The commercial surveillanceware industry is a lucrative market with big players evading oversight and exploiting vulnerabilities to stay ahead.Surveillanceware vendors are seeing business grow at an exponential rate, with prices increasing to match, reaching up to €6 million per infection in 2022.Companies like Apple and Microsoft are paying significant amounts for critical security flaws in their operating systems.The tech industry has launched legal action against surveillanceware snooping on its customers, but more worryingly, techniques are bleeding into the criminal malware market.Governments have tried to regulate the industry, but measures haven't stopped it internationally, with some worst offenders based in countries that signed up for regulation.The absence of effective political and regulatory safeguards has left spyware targets more exposed than ever, with vendors deploying increasingly covert and resilient attack vectors.
Commercial surveillanceware, a type of malicious software designed to secretly monitor and gather sensitive information from individuals or organizations, has become a lucrative industry with big players evading oversight and exploiting vulnerabilities to stay ahead. The Register's latest report highlights the alarming growth of this sector, which is not only used by governments but also by companies and individuals looking to gain an upper hand.
The report, conducted by security operations center specialist Sekoia, reveals that surveillanceware vendors are seeing business grow at an exponential rate, with prices increasing to match. For instance, in 2011, the Gamma Group, a British company offering FinFisher spyware to government agencies, charged €1,100 per infection. Just four years later, Italian vendor Hacking Team was offering similar attack code for €1 million for a full hacking service. By 2022, Candiru spyware biz had increased its prices to €6 million for surveillanceware-as-a-service operations.
These figures are not only indicative of the growing demand for surveillanceware but also highlight the increasing cost of acquiring vulnerabilities and exploits. The report notes that companies like Apple are now paying up to $1 million for a critical, zero-click flaw in their operating systems, while Microsoft paid out $17 million last year to those who poked holes in its code.
The tech industry has launched legal action against surveillanceware snooping on its customers, with Meta recently scoring a $168 million judgment against the Israeli NSO Group for hacking WhatsApp. However, more worryingly, it seems that surveillanceware vendors' techniques are bleeding into the criminal malware market. Researchers spotted Russia's Cozy Bear nation-state hacking group last year using surveillanceware flaws found in code from the NSO Group and others to attack Mongolia's Cabinet and Ministry of Foreign Affairs.
Governments have tried to regulate this industry, with the US sanctioning four companies, including the NSO Group, in 2021. However, these measures haven't stopped the industry internationally. Last year, 27 countries, including the US, signed up to the Pall Mall Process, calling for better regulation of the industry. Unfortunately, some of the worst surveillanceware offenders are based in countries that signed up and some signatories are even users of the technology.
The report notes that corporate renamings are commonplace as companies use resellers and shell firms to cover up activities. For example, when French outfit Amesys was caught selling surveillanceware to the Libyan regime, it split into two companies – Nexa Technologies, based in France, and Advanced Middle East Systems (AMESys) in Dubai – and retired the original brand.
The absence of effective political and regulatory safeguards has left spyware targets more exposed than ever, as infection techniques have grown more covert and resilient. Vendors now deploy a broader range of attack vectors, rely on stealthier command-and-control (C2) infrastructures, and exploit zero-day vulnerabilities with increasing frequency.
In conclusion, the commercial surveillanceware industry is a lucrative market that has become increasingly difficult to regulate. The growing demand for this type of software, coupled with the increasing cost of acquiring vulnerabilities and exploits, has led to a proliferation of malicious software that is being used by governments, companies, and individuals alike. As the tech industry continues to push back against surveillanceware snooping on its customers, it remains to be seen whether meaningful regulations will come from government activity.
Surveillanceware firms are raking in the cash while evading oversight and exploiting vulnerabilities for profit. The growing demand for this type of software has made it increasingly difficult to regulate, leaving targets more exposed than ever.
Related Information:
https://www.ethicalhackingnews.com/articles/The-Dark-Side-of-Security-How-Surveillanceware-Firms-are-Evading-Oversight-and-Exploiting-Vulnerabilities-for-Profit-ehn.shtml
https://go.theregister.com/feed/www.theregister.com/2025/09/02/commercial_surveillanceware_safe/
Published: Tue Sep 2 20:15:51 2025 by llama3.2 3B Q4_K_M
