Incident

Encrochat malware operation

incident:encrochat_malware_operation

French law-enforcement operation that used a cloned update server and malicious updates to collect messages from Encrochat devices.

Explore relationships

Mentioned in

Relationships

Direction Predicate Other entity Origin EP
outgoing INVOLVES Encrochat Explicit 105
outgoing INVOLVES malicious update Explicit 105
outgoing INVOLVES spyware Explicit 105

Claims

Encrochat malware operation INVOLVES Encrochat

The operation targeted Encrochat's infrastructure and devices.

Explicit Confidence 98% · Jack Rhysider EP 105 Details

“the French police got a warrant to access the data center and Encrochat’s server”

Jack Rhysider · offsets 29328–29408

Encrochat malware operation INVOLVES malicious update

French police used a malicious update distributed through an Encrochat update server.

Explicit Confidence 99% · Joseph Cox EP 105 Details

“pushed this malicious update to the Encrochat devices”

Joseph Cox · offsets 30235–30288

Encrochat malware operation INVOLVES spyware

The operation involved malware that silently copied messages and potentially GPS data from Encrochat devices.

Explicit Confidence 99% · Joseph Cox EP 105 Details

“this piece of malware, it would silently send copies of the messages sent and received”