--[ Anomaly #14 - What does it mean for a phone to be clean? ]--

A person arrives with a phone and a seemingly simple question: was I hacked?

Answering it is not that easy.

When we started delving into Android forensics at ZoqueLabs, one of the first things we had to learn was just that. We can search for suspicious applications, known indicators of compromise, check logs, network traffic, databases, and other system artifacts. We can find evidence that something happened. The difficult thing is to prove the opposite.

Tools like MVT are tremendously useful and have allowed many civil society organizations to do a first analysis of a device without having a forensic laboratory behind it. But it has an inevitable limitation: to a large extent we find the things we know how to look for. If we know a domain, process, file, or some other indicator related to a campaign, we can search for its traces. But what happens when we don’t know what we are looking for?

That’s where another part of the forensics begins.

Android is a huge system and, furthermore, saying “Android” is almost a simplification. A Pixel, a Samsung, a Xiaomi or a Huawei can share the same base and at the same time behave in quite different ways. There are different versions of the system, manufacturer modifications, proprietary drivers, pre-installed applications and different update policies.

Then something strange appears on a phone and the rabbit hole begins.

Lately, for example, we’ve been studying tombstones, the files that Android generates when a native process crashes. A strange crash can lead us to identify the library where it occurred, look at memory registers and addresses, disassemble ARM64 instructions, understand mechanisms such as PAC or BTI and end up reading documentation from a driver owned by the manufacturer. All to try to answer a question that at first seemed much simpler: why did this process crash?

Sometimes we find something interesting. Other times, after several hours or days, we conclude that probably nothing strange happened.

But it wasn’t wasted time.

Each of these investigations teaches us a little more about how Android behaves when it is not compromised, and that is essential to be able to recognize when something is out of the ordinary.

That is why we are also interested in studying malware that, in principle, has no relationship with civil society. Brazilian bankers, RATs, infostealers, stalkerware, botnets or published exploits teach us infection, persistence and evasion techniques. They show us how attackers communicate with their infrastructure, where they leave traces, and which ones they try to erase.

In digital security for civil society we talk a lot about Pegasus, Predator and other commercial spyware, and there are good reasons to do so. But when we receive a suspicious phone, it doesn’t come with a label saying what happened to it. It may have been commercial spyware, a fairly common RAT, an abusive application, phishing, exploitation of a vulnerability, or just some strange but legitimate system behavior.

Investigating the most sophisticated cases requires also understanding the least sophisticated ones.

And this brings us back to the initial question: what does it mean for a phone to be clean?

We should probably be careful using that word. An analysis can find evidence of compromise, but not finding it does not prove that it never existed. Logs disappear, systems change, tools have blind spots and so do we.

Learning forensics also means learning to recognize those limits: being able to say what we reviewed, what we can confidently dismiss, what we couldn’t observe, and what questions remain open.

We’ve been digging deeper and deeper into this burrow for a while now, and the more we learn about Android, the more we find things that we don’t know yet. Interestingly, we think that’s a good sign.

Because in forensics you know what to look for helps. Learning to keep searching when we still don’t know what we’re looking for helps a lot more.

And well, that’s where we are. :)

And we leave you with the Anomalies of this edition.

--[ Technical Analysis ]--

What do Operation Triangulation and Angry Spark have in common?

In this article, Bill Marczak describes a very interesting methodology with which they have managed to map malicious infrastructure and whose results have been making sense with more recent research. The technique, called IP-ESSENCE, makes it possible to identify C2 servers that are trying to hide behind proxy chains. The results are consistent with infrastructure related to two major cases: Operation Triangulation and a recent Gen Digital report on Angry Spark, a mysterious malware found on a computer in the United Kingdom. A very interesting and recommended read. [Bill Marczak Blog]

DarkSword continues to multiply after its leak

Censys continues to follow the infrastructure of DarkSword, the publicly leaked chain of six exploits for iOS 18.4–18.7 that is already in the hands of at least seven or eight different operators. In this research they managed to map a new cluster of more than 100 web properties operated by a Chinese-speaking actor, using hashes of the exploit panels and files as signatures that survive the constant rotation of IPs and domains. The infrastructure combines fake AWS and Apple ID pages with DarkSword and the GHOSTBLADE implant, capable of extracting credentials from the Keychain, iCloud, Wi-Fi networks and device files. [Censys]

Venezuela - Inside Lotus Wiper, the malware that attacked PDVSA

A new technical analysis reverses engineering of Lotus Wiper, the destructive malware used against PDVSA amid tensions between Venezuela and the United States. The samples are clearly adapted to the oil company: they include the domain pdvsa.com, a trigger that waits for a specific file in the Domain Controller and even a PdvsaAIT account that the malware preserves while disabling the others. Once activated, Lotus Wiper isolates machines from the network, destroys files and partitions, removes restore points, and deletes the USN Journal to make forensic analysis and recovery more difficult. The context of the attack is striking, but the analysis does not establish who was behind the operation. [0x0d4y.blog]

--[ Cyber-security Panorama ]--

Latin America, second region most exposed to attacks against industrial systems

A new report from Kaspersky ICS CERT places Latin America as the second most exposed region in the world to threats against industrial control systems, with 20.4% of ICS computers affected by malicious devices. Mail continues to be one of the main initial vectors: Mexico leads this indicator with 9.51 % of affected computers, followed by Uruguay with 8.56 %. Also striking is Panama, where 18.24% of ICS systems registered threats, partly due to targeted campaigns against government WordPress-based sites. In these types of environments, gaining credentials or initial access can pave the way to OT networks and critical processes. [cisoadvisor.com.br]

Brazil and Argentina among the countries most affected by Kimwolf

Data continues to emerge about the huge network of compromised Android devices that powers botnets, ad fraud, and residential proxy services. Among them is Kimwolf, a variant of the Aisuru DDoS botnet that would have infected more than two million Android devices, especially low-cost Smart TVs and TV Boxes. According to the report, Brazil and Argentina are among the most affected countries, along with Vietnam and Saudi Arabia. Devices can be compromised from the factory or infected through exposed ADB ports, then sell their connection as a residential proxy, force-install applications, or participate in DDoS attacks. [borncity.com]

Colombia and Brazil appear among the objectives of a campaign linked to China

SOCRadar found exposed a server used by a campaign linked to Chinese actors that contained a good part of its arsenal: recognition lists, exploits for nine vulnerabilities, Metasploit, tunneling tools, SNOWLIGHT and a cracked Chinese version of Cobalt Strike. The infrastructure reveals a massive scanning and exploitation operation against more than 9,990 hosts in 104 countries, with more than 85% of acknowledgment lists focused on government infrastructure. Colombia and Brazil appear explicitly among the target countries. The malware and other indicators of the operation are related to UNC5174/UNC6586, initial access actors linked to China. [socradar]

Colombia among the objectives of the StrikeShark campaign

Kaspersky revealed StrikeShark, a new campaign that uses previously undocumented malware, called SharkLoader, to deploy Cobalt Strike Beacon and maintain access to compromised networks. The infection combines exploitation of vulnerabilities in exposed services such as Microsoft Exchange, SharePoint, and Openfire with fake installers from Google Update and Cisco AnyConnect. Once inside, SharkLoader uses side-loading DLLs, encrypted modules and hooking APIs to evade detection. The campaign has affected government entities, diplomats and software companies in several countries, including Colombia, and for now Kaspersky does not attribute it to any known actors. [kaspersky]

Brazil concentrates 84% of the attack attempts registered in Latin America

According to FortiGuard Labs’ Global Threat Landscape 2026 report, Brazil recorded more than 753.8 billion attack attempts during 2025, equivalent to 84% of those detected in Latin America, and was among the seven countries with the highest volume worldwide. The report relates these figures to the consolidation of Cybercrime as a Service, which facilitates access to ransomware kits, phishing tools and access to compromised networks. Brazilian organizations receive on average about 3,520 attack attempts per week. [securityleaders.com.br]

Famous Chollima also looks towards Latin America

In the latest edition of the zine Paged Out!colombia, Mexico and Argentina are mentioned in an article about Famous Chollima, as the North Korean operation that infiltrates the country’s workers into foreign companies for financial or espionage purposes is known. The article, “Interviewing North Korean Agents”, documents a case in which they attempted to break into Latin American companies by posing as people from Colombia, Mexico, and Argentina. Curious. [pagedout 009]

--[ Leaks & Gaps ]--

Colombia - Ransomware against the Ministry of Justice?

The Colombian Ministry of Justice reported a ransomware attack that affected the availability of part of its services and forced some systems to be preventively isolated. However, so far no known group has claimed responsibility for the attack and no indicators of compromise, ransom notes, samples or information about the variant used have been published. MuchoHacker also failed to find the Ministry on ransomware group leak sites nor was it able to independently confirm the nature of the incident. For now we know that there was an incident, but technical details are missing to understand what really happened. [muchohacker]

Colombia - they sell alleged access to Emergia’s internal systems

An actor is allegedly offering access to the internal infrastructure of Emergia Customer Care Colombia, a BPO company that provides services to large telecommunications companies, on a cybercrime forum. For $999 at Monero, the seller claims to provide real-time access to analysis and machine learning models, monitoring tools, customer databases and administrative accounts. The interesting thing is that a static database is not being sold, but rather active access to internal systems, something that could facilitate new leaks, extortion or movement towards its clients’ infrastructure. For now, Brinztech has not independently verified the seller’s claims. [brinztech]

Colombia - The Gentlemen publishes the files it claims to have stolen from Ecopetrol

The extortion group The Gentlemen finally published the files it claims to have stolen from Ecopetrol, after having previously released a catalog of nearly 327,000 files and 1 TB of information. MuchoHacker reviewed some samples and found documents consistent with real corporate information, including official data, financial records, internal control forms and personnel documentation. However, it has not yet been possible to verify that all of the published material comes from Ecopetrol or that it corresponds to the volume originally announced by the attackers. [muchohacker]

--[ Censorship ]--

Venezuela - DDoS attacks as a censorship tool

An article from Tech Policy Press discusses how DDoS attacks can function as a form of censorship against independent media. The author studied 19 Venezuelan news sites for seven months between 2017 and 2018 and found that the attacks were concentrated around the elections and coincided with the publication of content on protests, repression, opposition and other politically sensitive topics. Although the study does not allow us to attribute who was behind the attacks, it shows how DDoS can introduce enough friction and costs to limit the reach of independent media and end up affecting their editorial work. [techpolicy.press]

Brazil - fake followers as electoral interference

Three PT leaders in Bahia denounced an attack against their Instagram accounts just before an electoral convention. In about five hours, the accounts of Governor Jerônimo Rodrigues, Senator Jaques Wagner and former Minister Rui Costa received around 70,000 followers of Asian origin. According to the coalition, the operation sought to appear to be a purchase of followers and, at the same time, try to get Meta to suspend the accounts due to manipulation of the platform. An interesting case of how relatively simple mechanisms can be used to interfere with the digital presence of political actors during the electoral period. [infomoney]

--[ Digital Violence ]--

Meta - thousands of ads for “nudify” applications

An investigation by the Tech Transparency Project found that GatherOne, one of Meta’s main authorized advertising partners in China, is listed as responsible for paying for thousands of ads on Facebook and Instagram for apps capable of “undressing” digitally to women or insert them into videos with explicit sexual content. TTP identified more than 7,600 ads for apps with these capabilities and found that many of the accounts continued advertising even after Meta removed ads for violating its policies. The case shows how tools for creating non-consensual intimate images are being marketed on a large scale using the platforms’ own advertising infrastructure. [techtransparencyproject.org]

--[ Privacy ]--

Failures in Private Relay can reveal the real IP of iOS users

Researchers found several flaws in Apple’s navigation engine that allow a website to obtain the real IP address of users who use iCloud Private Relay, the service designed precisely to hide it. The problem affects the engine used by all browsers on iOS and also affects OnionBrowser, an application that allows browsing through the Tor network. 404 Media verified that the techniques do indeed allow IP to be exposed and warns that some sites could have been collecting this information incidentally. [404media]

--[ Spyware Accountability ]--

Mexico - Sedena still has not delivered the Pegasus contracts

After four years of litigation, a Collegiate Court confirmed the protection obtained by R3D to force Sedena to deliver public versions of the contracts related to Pegasus signed in 2018 and 2019. The existence of at least two contracts, for more than 140 million pesos, was documented by the Spy Army investigation, despite the fact that Sedena had previously denied their existence. The INAI ordered its publication in 2023, but Sedena completely reserved the documents and remains undelivered to this day. The new ruling once again orders its publication and keeps open an important battle to learn how the Mexican State acquired surveillance technologies. [R3D]

--[ ZOLIM --> Snapshot 07/24/2026 ]--

13 new and very interesting IPs for this ZOLIM snapshot. With these we have already completed 232 detected servers since we started the observatory. :)

Some interesting signs:

• Mexico: two IPs on the same network segment (AS8151) hosting Sliver instances.
• Colombia: the IPs attributed to Blind Eagle continue to move. This time, in addition to the usual DCRat and AsyncRAT, we detected a new instance of Quasar.
• Chile: a new IP hosting CHAOS.
• Brazil: we detected a new instance of DCRat, something that until now has not been so common in ZOLIM data.

If you want to go deeper, take a look at ZOLIM. In the table at the bottom you can search and cross-reference the data by country, ASN, IP, threat, city and other fields. Each IP is a good excuse to start researching. :)

--[ Exfiltradaz - Snapshot from 07/24/2026 to 08/07/2026 ]--

During this period, 22 references to leaks and extortion operations related to seven Latin American countries were identified. In this period we once again saw Brazil as the country with the most references, followed by Mexico, where publications mainly appeared on databases and records related to the health sector. We observed 3 new actors d4rknethub, goodmails and mossad.

References to Uruguay, Peru, Chile, Colombia and Argentina were also recorded, including a ransomware claim against the Argentine Army, publications on electoral registration in Colombia and government entities in Brazil that would be interesting to review. More details of these leaks in Exfiltradaz.

--[ Exfiltradaz - Snapshot from 07/24/2026 to 08/07/2026 ]--

During this period, 22 references to leaks and extortion operations related to seven Latin American countries were identified. In this period we once again saw Brazil as the country with the most references, followed by Mexico, where publications mainly appeared on databases and records related to the health sector. We observed 3 new actors d4rknethub, goodmails and mossad.

References to Uruguay, Peru, Chile, Colombia and Argentina were also recorded, including a ransomware claim against the Argentine Army, publications on electoral registration in Colombia and government entities in Brazil that would be interesting to review. More details of these leaks in Exfiltradaz.