Türkiye-linked spy crew exploited a messaging app zero-day to snoop on Kurdish army in Iraq

Turkish spies exploited a zero-day bug in a messaging app to collect info on the Kurdish army in Iraq, according to Microsoft, which says the attacks began more than a year ago. Specifically, the snoops abused CVE-2025-27920, a directory traversal vulnerability in version 2.0.62 of messaging app Output Messenger, and the intrusions began in April 2024. The app's developer Srimax issued a software update in December to patch the hole, however not all users applied the fixes. The crew behind the intrusions, a Türkiye-affiliated espionage threat actor that Microsoft tracks as Marbled Dust, abused the flaw to steal user data belonging to the Kurdish military in Iraq, Redmond's threat intelligence team wrote on Monday. The Kurdish people live on land spanning Iran, Iraq, Syria, and Türkiye. The ethnic group aspires to create a sovereign state. Kurdish people have taken up arms to defend themselves against persecution. Türkiye opposes the formation of a Kurdish state, a motive for state-linked cyber crews to target Kurdish military operations. Srimax admitted to the flaw and published a security advisory in which it revealed "Attackers could access files such as configuration files, sensitive user data, or even source code, and depending on the file contents, this could lead to further exploitation, including remote code execution.” Srimax did not immediately respond to The Register's inquiries. Marbled Dust typically targets government institutions and organizations whose interest...