Landfall: Military-Grade Spyware Targeted Samsung Galaxy Devices…

Palo Alto Networks Unit 42 uncovered Landfall, a commercial-grade modular Android spyware that exploited the Samsung zero-day CVE-2025-21042 to target Galaxy devices in the Middle East from July 2024 through April 2025. The campaign remained undetected in public repositories for months until a parallel to an iOS exploit chain investigation.

Palo Alto Networks Unit 42 has unveiled Landfall, a modular commercial-grade Android spyware that targeted Samsung Galaxy users in the Middle East by exploiting the zero-day vulnerability CVE-2025-21042. The campaign remained active from July 2024 through April 2025, with malware samples present on VirusTotal as early as August 2024 without being identified as an advanced threat. The discovery emerged from an investigation into a related iOS exploit chain, revealing a cross-platform visibility gap in mobile threat intelligence.

Key Takeaways

Landfall exploits CVE-2025-21042 in the Samsung image processing library libimagecodec.quram.so, patched in April 2025
Delivery occurs via malformed DNG files with an embedded ZIP archive, likely distributed through WhatsApp
Primary targets are concentrated in Iraq, Iran, Turkey, and Morocco, focusing on Samsung Galaxy S22, S23, and S24 series
Unit 42 documented at least six C2 servers with infrastructure overlaps with Stealth Falcon, but does not confirm a link to the UAE government

How the Attack Chain Works: From DNG to Full Device Control

The initial entry point relies on an apparently innocuous format: DNG (Digital Negative), a raw photography standard. Landfall does not compromise the victim with a malicious application to install, but with an image file that, when opened or even merely processed by the Samsung library, triggers the exploit. Unit 42 confirmed that analyzed samples contain a ZIP archive appended to the DNG file: this hybrid structure forces the libimagecodec.quram.so parser into unexpected behavior.

From the compromised process memory emerges the primary payload: a 106 KB ARM64 ELF loader named b.so, stripped to hinder analysis. This component in turn installs l.so, a manipulator of SELinux policies that lowers the Android operating system's security barriers. The combination enables elevated privileges and persistence beyond normal application sandboxing.

The surveillance capabilities documented by Unit 42 include conversation recording, location tracking, photo capture via camera, contact and call log collection, device fingerprinting, data exfiltration, and dynamic download of additional modules. Communication with command-and-control servers occurs over modular infrastructure: Unit 42 identified at least six.

The Archaeological Find: From VirusTotal to a Hidden Campaign

The most unsettling finding is not technical, but epistemological. DNG samples with documented SHA256 hashes — including ffeeb0356abb56c5084756a5ab0a39002832403bca5290bb6d794d14b642ffe2 (b.so, July 23, 2024) and c0f30c2a2d6f95b57128e78dc0b7180e69315057e62809de1926b75f86516b2e (DNG, August 27, 2024) — had already been present on VirusTotal for months. No detection engine had classified them as a zero-day exploit of commercial spyware.

"From the initial appearance of samples in July 2024, this activity highlights how sophisticated exploits can remain in public repositories for an extended period before being fully understood" — Unit 42

The discovery occurred indirectly. Unit 42 was investigating an iOS exploit chain — the one associated with CVE-2025-43300 (CVSS 10.0 CRITICAL, reported by CISA-ADP) and CVE-2025-55177 (CVSS 5.4 MEDIUM, scored by Facebook CNA) — when a retro-hunt on public repositories surfaced the correlated Android samples. The original research on the Apple platform thus revealed that the same offensive infrastructure operated in parallel, and previously, on Samsung devices as well. Unit 42 noted in its blog: "Our finding predates these disclosures — the LANDFALL campaign was already operating in mid-2024, using the zero-day Android/Samsung vulnerability (CVE-2025-21042) months before it was fixed."

Attribution and Limits: Stealth Falcon, PSSO, and the Gap on Sponsors

Unit 42 detected "multiple overlaps" between Landfall's C2 servers and infrastructure associated with Stealth Falcon, a group tracked publicly for years. However, the leap from technical overlap to political attribution remains unconfirmed. Unit 42 itself, cited by Dark Reading, expressed caution: "Circumstantial evidence suggests there could be a link between this group and the United Arab Emirates (UAE) government, but that has not been confirmed." The dossier also does not identify the specific vendor of the offensive tools, noting only possible links to "private-sector offensive actors" (PSSO) outside the NSO Group ecosystem.

The context is relevant: the proliferation of military-grade commercial spyware has expanded well beyond a single Israeli vendor. Landfall confirms that actors with intermediate resources can obtain cross-platform capabilities, including zero-days, for targeting activists, journalists, and political figures in high-risk geographic areas. The absence of confirmation does not erase the gravity of the pattern; methodological caution serves to avoid prematurely closing an investigation that could expand.

What to Do Now

Verify the April 2025 patch level on Samsung Galaxy S22/S23/S24 devices: CVE-2025-21042 was fixed by Samsung in that cycle; unpatched devices remain exposed if the exploit is re-adapted
Treat image files from known contacts with the same caution as executable attachments: the Landfall chain demonstrates that native library parsing can be attacked without significant user interaction
Review retro-hunt policies on public repositories like VirusTotal: organizations with threat intelligence teams should integrate cross-platform historical search, not siloed by operating system
Monitor the evolution of the libimagecodec.quram.so library and WhatsApp advisories: the same platform reported CVE-2025-21043 to Samsung in September 2025, indicating a pattern of vulnerabilities in the image processing attack surface that may not be exhausted

Why This Discovery Changes the Mobile Threat Intelligence Paradigm

Landfall is not just a new name in the spyware catalog. It demonstrates that the separation between iOS and Android ecosystems in security research is an organizational convention, not a technical barrier for attackers. The same commercial operators developed parallel capabilities, operated for months on public repositories without being intercepted, and exploited zero-day vulnerabilities in native components — not in app stores, not in browsers, but in image parsing.

For mobile security firms, the message is specific: native image processing libraries, often overlooked compared to the kernel or bootloader, represent a mature attack surface. For Samsung users in geopolitically sensitive areas, the confirmation that seemingly benign photo files can deliver exploits without additional clicks adds a concrete threat level to a daily practice. For those who gather and analyze intelligence, Landfall is a warning on the value of retro-analysis: sometimes the future of a threat is already in the past, archived and unrecognized.

Frequently Asked Questions

Is WhatsApp vulnerable in Landfall's Android chain?

Unit 42 explicitly ruled out having identified zero-day vulnerabilities in WhatsApp for Android delivery. The "likely delivered via WhatsApp" refers to the distribution vector for DNG files, not a flaw in the messaging app itself. The situation differs from the correlated iOS chain, where CVE-2025-55177 involved WhatsApp.

Can non-Samsung devices be affected?

The dossier limits the target to Samsung Galaxy S22, S23, and S24 series. The vulnerability resides in Samsung's proprietary libimagecodec.quram.so library; no evidence of porting to other Android hardware families has emerged.

Is there a risk of active infection now?

According to Unit 42, "no ongoing risk to current Samsung users" who have applied the April 2025 patch. The documented activity concluded in that timeframe, although reuse of infrastructure or techniques remains theoretically possible.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references