🧠 Food for thought

Implications, context, and why it matters.

SIO’s fake apps have been tied to multi-year spyware activity

• Investigators tied the Italian spyware maker SIO, which sells its tools to government agencies, to a similar Android campaign that has run for years 1.
• Its Android malware, codenamed Spyrtacus, has operated since at least 2019, with samples posing as apps for Italian telecom providers such as TIM, Vodafone, and WINDTRE 1.
• The code can pull chats from Signal and WhatsApp, record phone calls, capture room audio through the microphone, and take images through the cameras 1.
• Evidence also includes command-and-control servers registered to ASIGINT, described as an SIO subsidiary, plus a LinkedIn post where ASIGINT CEO Michele Fiorentino referenced the Spyrtacus Project 1.

Spyware vendors and their investors face growing legal and accountability pressure

• WhatsApp’s planned lawsuit against SIO follows earlier moves that ended with a roughly $167.7 million jury verdict against NSO Group for using Pegasus to target WhatsApp 2.
• Tech platforms are taking a bigger role in enforcement through attack detection, victim alerts, and court action against vendors 3.
• Money and reputation can take a hit. After claims that Paragon Solutions’ Graphite spyware targeted critics of the Italian government, Paragon reportedly cut off access for its clients in Italy 4.
• Backers also face blowback. Access Now, a digital rights advocacy group, wrote that Novalpina Capital Partners led the fund that acquired NSO Group, and that fund was later liquidated after years of scrutiny including sanctions and legal cases 5.