LANDFALL spyware exploited Samsung zero-day CVE-2025-21042 in Middle East attacks

LANDFALL spyware was used to exploit Samsung’s zero-day, CVE-2025-21042, in targeted Middle East attacks, with researchers tracing the campaign to months before Samsung patched the flaw in April 2025. The malware was embedded in DNG image files sent via WhatsApp, targeting Galaxy devices such as S22–S24, Fold4 and Flip4, and it enabled zero-click surveillance, including audio recording, location tracking and data exfiltration.

The campaign, tracked as CL-UNK-1054, used six known C2 servers across Europe and appears connected to a broader wave of image-based exploits affecting Android and iOS, according to Unit 42 researchers. The targets identified by VirusTotal data include Iraq, Iran, Turkey and Morocco, though attribution to a specific threat actor remains unproven; researchers note similarities in C2 infrastructure and domain patterns to Stealth Falcon, without confirmation of a link.

According to Palo Alto Networks Unit 42, LANDFALL represents a commercial-grade spyware family with sophisticated stealth and persistence capabilities deployed via a zero-day in Samsung’s image-processing library.