Loading threat actor…
Variston is a Barcelona, Spain-based commercial spyware and exploit vendor associated with the Heliconia exploitation framework and BridgeHead spyware implant. It develops offensive capabilities used for surveillance, including exploitation of zero-day vulnerabilities affecting browsers and mobile devices. Variston is a commercial surveillance supplier rather than an identified state-sponsored intrusion group; state-sponsored operators have used its spyware. A campaign discovered in March 2023 targeted iPhones in Indonesia running iOS 16.3.0 and 16.3.1. Attackers delivered links through SMS and sought to deploy BridgeHead through Heliconia. The activity involved exploitation of CVE-2023-28205, CVE-2023-28206, and CVE-2023-32409, which Apple patched in April and May 2023. Variston has also been associated with exploitation of the Firefox vulnerability CVE-2022-26485 and weaponization of the Qualcomm Adreno GPU vulnerability CVE-2023-33063.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
Attributed origin per open-source reporting.
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 CVEs this actor has used in observed campaigns. 5 of them exploited in the wild.
Variston, identified by Google TAG targeting Mozilla's Firefox browser (CVE-2022-26485)
Unknown state-sponsored actors exploited CVE-2023-28205, CVE-2023-28206, and CVE-2023-32409 as zero-days to infect victims with spyware developed by Variston.
Unknown state-sponsored actors exploited CVE-2023-28205, CVE-2023-28206, and CVE-2023-32409 as zero-days to infect victims with spyware developed by Variston.
Unknown state-sponsored actors exploited CVE-2023-28205, CVE-2023-28206, and CVE-2023-32409 as zero-days to infect victims with spyware developed by Variston.
Also weaponized by Variston is a high-severity security shortcoming in Qualcomm chips (CVE-2023-33063) that first came to light in October 2023.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Commercial spyware/exploit vendor (PSOA) referenced due to naming convention overlap (“BridgeHead”) and reported association with the Heliconica framework; discussed as a possible (non-confirmed) linkage point for LANDFALL’s tradecraft.
Barcelona-based spyware developer whose BridgeHead implant and Heliconia exploitation framework were used by unnamed state-sponsored actors against iPhones in Indonesia. The article links Variston to three iOS zero-days and explicitly states that it also weaponized a Qualcomm vulnerability. It does not identify Variston as the operator of the Indonesian campaign.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.