Loading story…
Researchers published detailed reverse-engineering work on FinFisher/FinSpy spyware, showing how the surveillance tool hides its payload behind heavy anti-analysis protections and a proprietary virtual machine. ESET documented Windows samples that use complementary conditional-jump pairs after nearly every instruction to break disassembly, then decrypt and execute protected bytecode through a custom virtual CPU. The whitepaper describes how analysts can peel back those layers by reconstructing components such as vm_start, vm_dispatcher, vm_context, and vm_handlers, noting that the examined VM used 34 handlers and could mix virtualized logic with native instructions when full virtualization was impractical.
Additional reverse-engineering research expanded on that work by demonstrating how to simplify and devirtualize FinSpy bytecode into equivalent x86 logic. The analysis focused on removing instruction patterns tied to a dedicated SCRATCH register, replacing them with canonical VM forms or direct x86 operations, and decoding sequences that represented x86-style memory addressing and memory access. After those transformations, the remaining bytecode was reduced largely to branch and raw x86-related instructions, and the researcher also corrected an earlier interpretation of one opcode, concluding that a supposed CRASH instruction was actually an unconditional jump. Together, the findings show that FinFisher’s protections were built to frustrate reverse engineering and conceal configuration data and newer spyware capabilities.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On 2018-02-21, a Möbius Strip Reverse Engineering blog post detailed a phase of devirtualizing a FinSpy VM bytecode program by simplifying and eliminating Group #2 SCRATCH-register instructions. The post also corrected a prior reverse-engineering error by identifying a previously labeled "CRASH" instruction as an unconditional jump.
In January 2018, ESET published a whitepaper by Filip Kafka analyzing FinFisher's anti-disassembly protections and custom virtual machine used to conceal its payload. The paper documented deobfuscation and devirtualization techniques for the Windows spyware samples.
ESET reported that it discovered FinFisher surveillance campaigns in several countries during the summer of 2017. The company said some campaigns most probably involved internet service providers playing a key role in compromising victims.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reverse-engineering researchers published tooling and documentation that expose the inner workings of **FinSpy**, including a static unpacker, VM disassembler, and deobfuscation components hosted in the `RolfRolles/FinSpyVM` repository. The work targets FinSpy's custom virtual machine protection and provides practical artifacts for analysts to reconstruct protected code, while separate public documentation from the Chaos Computer Club details analysis of FinSpy for Android and includes leaked files, samples, graphs, tables, and a report on the spyware's components. A technical walkthrough describing the devirtualization process said the analyzed FinSpy sample relied on a comparatively weak virtualization scheme in which much of the VM bytecode already contained raw `x86` machine code. The author outlined a four-stage method for simplifying bytecode, recovering virtualized function calls and pointers, and performing a second devirtualization pass to produce a complete `x86` code blob for loading into IDA, giving defenders and malware analysts a clearer path to inspect FinSpy behavior and internals.
Aug 15, 2026
New reverse-engineering by **Jamf Threat Labs** of an iOS **Predator** commercial spyware sample found previously undocumented anti-analysis and “deployment troubleshooting” capabilities that help operators understand *why* an infection attempt failed. The analysis describes an internal **error-code taxonomy** that reports specific failure conditions back to Predator’s command-and-control infrastructure, including `error code 304` indicating the target device is running security or analysis tooling; Jamf assessed this turns failed deployments into actionable diagnostic events for operators rather than opaque failures. Jamf also reported additional stealth and evasion features, including suppression of crash artifacts and mechanisms intended to hinder researcher analysis and user detection. Reported capabilities include checks for tools such as **Frida** and even utilities like `netstat`, suggesting Predator attempts to detect both professional analysis environments and privacy-conscious user behavior. Dark Reading highlighted that these telemetry and reporting behaviors imply **Intellexa** (Predator’s vendor) may have more visibility into, and potential control over, deployments than commercial spyware vendors typically claim, and noted other technical elements Jamf described such as crash reporting/monitoring and iOS *SpringBoard* hooking intended to conceal recording indicators.
Jun 29, 2026
Researchers analyzing a **SystemBC** malware sample found it was protected by **VMProtect 3.6+**, which used layered anti-analysis techniques to frustrate debugging and unpacking. The protection chain reportedly included multiple debugger-detection methods, direct system calls, Windows build-number validation through structures such as `KUSER_SHARED_DATA`, fresh `NTDLL` remapping, and syscall-number extraction designed to evade user-mode hooks. The sample also appeared to rely on well-known anti-debugging and evasion patterns documented in public research, including low-level checks associated with segment handling and other debugger-detection tricks. The analysts said VMProtect also performed anti-virtualization checks using **CPUID**, trap-flag behavior, and firmware-table inspection, exposing artifacts left by some older **VirtualBox** environments. To bypass those defenses, they modified **ScyllaHide** to spoof additional version fields, hook more APIs, change section-mapping behavior, and suppress firmware-table results. Those countermeasures allowed them to debug and unpack the malware, revealing that the **SystemBC** payload had been packed a second time beneath the VMProtect layer.
Aug 15, 2026