Incident Types: The types of cybersecurity incidents that have occurred include Cyber Attack, Vulnerability and Breach.

Detection and Response: The company detects and responds to cybersecurity incidents through an containment measures with took off systems, and remediation measures with strengthened security systems, and remediation measures with software update, and communication strategy with warned customers to be on the lookout for unauthorized communications, communication strategy with offered free credit report, and remediation measures with issued patches and updates, and and third party assistance with unit 42 (palo alto networks), and containment measures with samsung security patches (april 2025, september 2025), containment measures with palo alto networks detection updates (advanced wildfire, url filtering, dns security, threat prevention), and remediation measures with device security updates, remediation measures with malware signature updates, and communication strategy with public advisory via unit 42 report, communication strategy with media coverage, and enhanced monitoring with palo alto networks threat detection tools, and incident response plan activated with yes (by samsung and palo alto networks unit 42), and third party assistance with palo alto networks unit 42, and containment measures with patch released by samsung (april 2025), and remediation measures with device updates, remediation measures with monitoring for anomalous behaviors (e.g., c2 connections, suspicious image files), and communication strategy with public disclosure by palo alto networks unit 42, communication strategy with security advisories, and enhanced monitoring with recommended (for anomalous network connections, microphone usage, etc.)..

Common Attack Types: The most common types of attacks the company has faced is Vulnerability.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Path Traversal, malicious DNG files via WhatsApp, Malformed DNG image files (e.g. and WhatsApp transfers)Potential zero-click exploit via messaging apps.

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Source Code, , Name, Contact Details, Demographic Data, Date Of Birth, Product Registration Data, , Pii (Contacts, Sms, Photos), Geolocation Data, Call Logs, Microphone Recordings, , Audio Recordings, Location Data, Photos, Sms, Files, Contacts, Call Logs and .

Incident Response Plan: The company's incident response plan is described as Yes (by Samsung and Palo Alto Networks Unit 42).

Third-Party Assistance: The company involves third-party assistance in incident response through Unit 42 (Palo Alto Networks), , Palo Alto Networks Unit 42, .

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Strengthened security systems, , Software update, Issued patches and updates, , device security updates, malware signature updates, , Device updates, Monitoring for anomalous behaviors (e.g., C2 connections, suspicious image files), .

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by took off systems, , samsung security patches (april 2025, september 2025), palo alto networks detection updates (advanced wildfire, url filtering, dns security, threat prevention), , patch released by samsung (april 2025) and .

Key Lessons Learned: The key lessons learned from past incidents are The incident underscores the critical need for timely patch management to avoid opportunistic bottleneck attacks on nontraditional devices.Zero-day vulnerabilities in image processing libraries are increasingly weaponized across mobile platforms (similar iOS exploits in 2025).,Commercial spyware actors leverage ephemeral infrastructure (e.g., non-standard TCP ports) and modular architectures to evade detection.,Supply chain risks extend to messaging platforms (WhatsApp) used as delivery mechanisms, even without platform vulnerabilities.,SELinux policy manipulation is a critical evasion technique for Android malware persistence.Image-processing libraries (e.g., DNG/TIFF) are emerging as critical attack surfaces in mobile devices.,Messaging apps and 'image' files can serve as stealthy initial vectors for advanced malware.,Modular spyware architectures (loader + privilege escalation + C2) resemble commercial spyware, suggesting targeted espionage motives.,Mobile devices, especially flagship models, must be treated as high-value targets for espionage, not just commodity malware.,Long exposure windows (e.g., vulnerability exploited since July 2024, patched in April 2025) highlight the need for proactive monitoring and rapid patching.

Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Implement endpoint detection and response (EDR) solutions capable of detecting mobile spyware behaviors., Monitor for anomalous behaviors: unexpected network connections (C2 indicators), suspicious image files via chat apps, unauthorized microphone/camera usage., Educate users on the risks of malformed image files and social engineering via messaging platforms., Review and enforce messaging-app usage policies, including scrutiny of attachments (even from trusted sources)., Ensure all Samsung devices are updated to the latest firmware (post-April 2025 patch)., Treat mobile devices as potential espionage targets and especially in high-risk regions or sectors..

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Unit 42 (Palo Alto Networks), and Source: VirusTotal (malicious DNG samples)Url: https://www.virustotal.com, and Source: Samsung Security Updates (CVE-2025-21042, CVE-2025-21043), and Source: Palo Alto Networks Unit 42 Research Report, and Source: Samsung Security Advisory (CVE-2025-21042), and Source: Meta Platforms/WhatsApp Disclosure (CVE-2025-55177).

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Warned Customers To Be On The Lookout For Unauthorized Communications, Offered Free Credit Report, Public Advisory Via Unit 42 Report, Media Coverage, Public Disclosure By Palo Alto Networks Unit 42 and Security Advisories.

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Warned Customers To Be On The Lookout For Unauthorized Communications, Offered Free Credit Report, , Palo Alto Networks Customers Notified Via Product Updates, Samsung Security Bulletins, Media Reports, , Apply Patches Immediately, Monitor For Indicators Of Compromise (Iocs), Review Mobile Security Policies, Update Devices To The Latest Samsung Firmware, Avoid Opening Suspicious Image Files From Unknown Sources, Report Unusual Device Behaviors (E.G., Unexpected Recordings, Location Tracking) and .

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Unit 42 (Palo Alto Networks), , Palo Alto Networks Threat Detection Tools, , Palo Alto Networks Unit 42, , Recommended (for anomalous network connections, microphone usage, etc.).

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Apply the patch released by Samsung in August 2024, Samsung Patched Cve-2025-21042 (April 2025) And Cve-2025-21043 (September 2025)., Palo Alto Networks Updated Detection Signatures For Landfall Indicators., Ongoing Attribution Analysis By Unit 42 (Cl-Unk-1054)., , Samsung Issued Patches For Cve-2025-21042 (April 2025)., Public Disclosure By Unit 42 To Raise Awareness And Prompt Mitigations., Recommendations For Organizations To Treat Mobile Devices As High-Value Espionage Targets., Encouragement For Users To Update Devices And Scrutinize Messaging App Attachments., .

Last Attacking Group: The attacking group in the last incident were an Lapsus$ hacker group, Hackers, Hackers, Hackers at Pwn2Own Event, potentially linked to Stealth Falconpossible ties to Variston spyware frameworkprivate sector offensive actors (PSOAs), Name: Stealth Falcon (aka FruityArmor)Confidence: Moderate (based on domain registration and C2 patterns and but no definitive attribution).

Most Recent Incident Detected: The most recent incident detected was on 2015.

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2025-04-01.

Most Recent Incident Resolved: The most recent incident resolved was on 2022.

Most Significant Data Compromised: The most significant data compromised in an incident were Source code of Galaxy devices, , name, contact details, demographic data, date of birth, product registration data, , microphone recordings, location data, call logs, photos, contacts, SMS messages, , Microphone Audio/Call Recordings, Device Location, Photos, SMS, Files, Contacts, Call Logs and .

Most Significant System Affected: The most significant system affected in an incident was Samsung Galaxy S21Samsung Galaxy S22 and and Samsung Galaxy S22/S23/S24Z Fold4Z Flip4 and Samsung Galaxy S22Samsung Galaxy S23Samsung Galaxy S24Samsung Galaxy Z Fold 4Samsung Galaxy Z Flip 4.

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was unit 42 (palo alto networks), , palo alto networks unit 42, .

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Took off systems, Samsung security patches (April 2025, September 2025)Palo Alto Networks detection updates (Advanced WildFire, URL Filtering, DNS Security, Threat Prevention) and Patch released by Samsung (April 2025).

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Source code of Galaxy devices, Files, contact details, location data, microphone recordings, demographic data, SMS, name, Microphone Audio/Call Recordings, SMS messages, call logs, product registration data, photos, Photos, Contacts, contacts, date of birth, Call Logs and Device Location.

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Long exposure windows (e.g., vulnerability exploited since July 2024, patched in April 2025) highlight the need for proactive monitoring and rapid patching.

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Implement endpoint detection and response (EDR) solutions capable of detecting mobile spyware behaviors., Apply Samsung security patches promptly (April 2025 or later)., Monitor for anomalous behaviors: unexpected network connections (C2 indicators), suspicious image files via chat apps, unauthorized microphone/camera usage., Audit device permissions and SELinux policies for anomalies., Educate users on the risks of malformed image files and social engineering via messaging platforms., Review and enforce messaging-app usage policies, including scrutiny of attachments (even from trusted sources)., Treat mobile devices as potential espionage targets, especially in high-risk regions or sectors., Deploy advanced threat detection tools (e.g., Palo Alto Networks’ WildFire)., Monitor for suspicious DNG/JPPEG files received via messaging apps., Educate users on risks of unsolicited image files, even from known contacts., Investigate potential links to commercial spyware vendors (e.g., NSO Group, Variston). and Ensure all Samsung devices are updated to the latest firmware (post-April 2025 patch)..

Most Recent Source: The most recent source of information about an incident are Samsung Security Advisory (CVE-2025-21042), Unit 42 (Palo Alto Networks), VirusTotal (malicious DNG samples), Samsung Security Updates (CVE-2025-21042, CVE-2025-21043), Palo Alto Networks Unit 42 Research Report and Meta Platforms/WhatsApp Disclosure (CVE-2025-55177).

Most Recent URL for Additional Resources: The most recent URL for additional resources on cybersecurity best practices is https://www.virustotal.com .

Current Status of Most Recent Investigation: The current status of the most recent investigation is ongoing (tracked as CL-UNK-1054 by Unit 42).

Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was Palo Alto Networks customers notified via product updates, Apply patches immediately, Monitor for indicators of compromise (IoCs), Review mobile security policies, .

Most Recent Customer Advisory: The most recent customer advisory issued were an Warned customers to be on the lookout for unauthorized communicationsOffered free credit report, Samsung security bulletinsmedia reports, Update devices to the latest Samsung firmwareAvoid opening suspicious image files from unknown sourcesReport unusual device behaviors (e.g., unexpected recordings and location tracking).

Most Recent Entry Point: The most recent entry point used by an initial access broker were an malicious DNG files via WhatsApp and Path Traversal.

Most Recent Reconnaissance Period: The most recent reconnaissance period for an incident was 2024-01 to 2025-02 (samples uploaded to VirusTotal).

Most Significant Root Cause: The most significant root cause identified in post-incident analysis was CVE-2024-7399 vulnerability, Unpatched zero-day in Samsung’s image processing library (CVE-2025-21042).Lack of validation for malformed DNG files in Android’s media stack.Exploitation of WhatsApp as a trusted delivery vector.Commercial spyware tradecraft (e.g., modular architecture, evasion techniques)., Zero-day vulnerability (CVE-2025-21042) in Samsung’s image-processing library (libimagecodec.quram.so).Lack of user awareness about risks associated with image files via messaging apps.Delayed patching (vulnerability exploited since July 2024, patched in April 2025).Sophisticated modular spyware design (LANDFALL) enabling privilege escalation and persistence..

Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Apply the patch released by Samsung in August 2024, Samsung patched CVE-2025-21042 (April 2025) and CVE-2025-21043 (September 2025).Palo Alto Networks updated detection signatures for LANDFALL indicators.Ongoing attribution analysis by Unit 42 (CL-UNK-1054)., Samsung issued patches for CVE-2025-21042 (April 2025).Public disclosure by Unit 42 to raise awareness and prompt mitigations.Recommendations for organizations to treat mobile devices as high-value espionage targets.Encouragement for users to update devices and scrutinize messaging app attachments..