LANDFALL

LANDFALL is a commercial-grade Android spyware family targeting Samsung Galaxy devices. It was used in targeted surveillance operations primarily affecting users in the Middle East, with reported victimology including Iraq, Iran, Turkey, and Morocco. The malware was delivered by exploiting CVE-2025-21042, a Samsung-specific zero-day in the image-processing library used to parse DNG images. Delivery appears to have occurred through malicious DNG image files sent via WhatsApp, and the exploit chain may have operated in a zero-click manner without requiring user interaction. There is no evidence that the campaign relied on an unknown WhatsApp vulnerability; the messaging application appears to have served as a delivery channel for the crafted image files.

The implant is modular and includes a loader or backdoor component referred to as Bridge Head, along with a helper component designed to manipulate SELinux policy in order to obtain elevated permissions and support persistence. Reported surveillance functions include microphone and call recording, location tracking, and collection of photos, contacts, call logs, SMS or messaging data, and arbitrary files. Additional post-compromise capabilities include arbitrary command execution, in-memory and on-disk code loading, process injection, and use of LD_PRELOAD-style execution. The malware also incorporates defense-evasion measures such as checks for TracerPid, Frida, and Xposed, and uses HTTPS communications with certificate pinning for command-and-control.

LANDFALL has been described as part of the broader commercial mobile spyware ecosystem. Infrastructure and registration-pattern similarities have been noted with activity associated with Stealth Falcon, a threat actor long suspected of links to the United Arab Emirates, but no strong direct attribution has been established. The campaign was active by at least mid-2024 and specifically targeted recent Samsung flagship device families, including Galaxy S22, S23, S24, and Fold and Flip models.