Hacking Team

Executive Summary

Hacking Team is a well-known Italian vendor of surveillance and espionage tools that has faced significant scrutiny due to its alleged sales of technology to authoritarian regimes. Following a major breach in 2015, which exposed sensitive data including customer lists, communications, and source code, the company has potentially returned to operations but with new investors linked to Saudi Arabia. The group's tools have been used by various APT actors globally, making it a significant concern for organizations targeted by these campaigns.

Goals & Targeting

Hacking Team primarily targeted governments and their agencies across the world to enable state-sponsored surveillance activities. Their products were sold to law enforcement and intelligence agencies as tools for monitoring suspect communications. Post-2015 breach, while not directly tied, APT groups have exploited the leaked information from Hacking Team's database, using the 0-days and source code to develop their own espionage campaigns. The targeting profile suggests a focus on authoritarian regimes and law enforcement entities but also extends to broader intelligence gathering activities.

Hacking Team was founded in 2003 and specializes in developing Remote Control System (RCS) spyware that enables governments to extract sensitive information from devices. The company's products include interception of emails, instant messages, activation of cameras, and microphones remotely. Hacking Team has faced criticism for selling these tools to authoritarian regimes. On July 2015, the company suffered a severe security breach where approximately 400GB of internal data was leaked online. This included detailed customer lists, internal communications, and software source code. The breach led to significant public scrutiny and forced Hacking Team to request their customers to halt use of RCS. Six months later, new samples of Hacking Team's Mac spyware were identified in the wild, suggesting a potential resurgence. In 2017, Tablem Limited, an investment company based in Cyprus with ties to Saudi Arabia, acquired a 20% stake in Hacking Team, signaling a shift in ownership and potentially indicating renewed efforts. Post-breach, the company has remained under surveillance by the cybersecurity community, with concerns about its potential re-entry into global markets.

Key Capabilities

• Development of advanced spyware like Remote Control System (RCS)
• Exfiltration of files, emails, and instant messages
• Remote activation of device cameras and microphones for surveillance
• Custom exploit development and distribution
• Possession of a vast collection of 0-day vulnerabilities

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Hacking Team's post-breach activities suggest a potential resurgence in the surveillance tools market, with new products or updates to existing software identified as early as 2015. The company's rebranding and acquisition by Tablem Limited may indicate efforts to re-establish itself in the global market under new leadership. APT groups are known to have used Hacking Team's leaked tools, leading to an increased number of espionage campaigns targeting government and private sector entities.

IOC Patterns

• Spear-phishing emails with malicious attachments containing RCS components
• Use of compromised legitimate domains for command-and-control (C2) communication
• Indicators of web-based exploitation frameworks used in surveillance campaigns
• Presence of RCS-related file hashes and signatures in network traffic

Recommended Actions

• Monitor for suspicious activity related to known Hacking Team tools and their attack patterns.
• Implement strict access controls on sensitive systems using the principle of least privilege.
• Conduct regular vulnerability assessments to mitigate potential 0-day exploitation.
• Enhance endpoint detection capabilities to identify RCS-like surveillance behaviors.

Suggested Tags