CL-UNK-1054

CL-UNK-1054 is an unattributed spyware operator tracked for exploiting the Samsung Galaxy zero-day vulnerability CVE-2025-21042 to deploy the Android surveillance implant LANDFALL in targeted attacks. The activity has been associated with victims in the Middle East and North Africa, with potential targeting identified in Iraq, Iran, Turkey, and Morocco. The operator has been linked to attacks against Samsung Galaxy devices through malicious Digital Negative image files delivered via WhatsApp, with reporting indicating the exploit chain may have functioned as a zero-click infection path. LANDFALL is a full-featured mobile spyware platform used for covert surveillance and data theft. Reported capabilities include collection of microphone audio, location data, photos, contacts, SMS messages, files, and call logs, followed by beaconing to command-and-control infrastructure over HTTPS to retrieve additional payloads. The exploit chain reportedly used crafted image files containing appended archive content to extract shared libraries, execute the spyware, and weaken SELinux policy enforcement to obtain elevated permissions and maintain persistence on compromised devices. The actor demonstrates advanced mobile exploitation and post-compromise tradecraft, including initial access through a zero-day, privilege escalation through security policy manipulation, persistence, and exfiltration. Attribution remains unresolved. Infrastructure and domain-registration patterns have been assessed as resembling Stealth Falcon, also known as FruityArmor, but no direct overlap has been established. Reporting also noted development cues loosely resembling commercial surveillance vendors such as NSO Group, Variston, or Cytrox, but these links are not conclusive and do not support firm attribution.