Historical intelligence backfill. This assessment covers reporting originally published on 2025-11-07 and was added to the RWP archive on 2026-09-07.

Daily Top · Nation-State

LANDFALL was a year of Samsung zero-click — WhatsApp image, CVE-2025-21042, Middle East targeting

Unit 42 7 November 2025 — commercial-grade Android spyware on Galaxy S22/S23/S24 and Z Flip/Fold 4. Zero-day in Samsung image processing, likely zero-click via messaging. Active from July 2024 until Samsung’s April 2025 patch. Iraq, Iran, Turkey, Morocco.

RWP Ventures · 2026-09-07 · event 2025-11-07 · 1 min read · priority 8.6

Bottom line up front

CONFIRMED 7 November 2025 Unit 42 — LANDFALL, commercial-grade Android spyware. First seen July 2024. Exploit: CVE-2025-21042 in Samsung’s image-processing library, RCE, likely zero-click via a crafted image in a messenger (WhatsApp named in secondary reporting). Unit 42 did not claim a new WhatsApp bug. Samsung patched April 2025; the 0-day year is the story. Code references Galaxy S22, S23, S24, Z Flip 4, Z Fold 4; Android 13–15 in Unit 42/Register telling. Capabilities: contacts, files, photos, history, mic, camera, location. Targeting: precision, Middle East — Iraq, Iran, Turkey, Morocco (Unit 42 to The Register). Turkey USOM flagged a C2 IP.

This is mercenary spyware, not a botnet. Patch status in late 2025 is “apply April 2025+,” not “unpatched today.”

What happened

Send a picture. Own the phone. No tap required if the chain is true zero-click.

Why it matters

Executives on Galaxy in those regions were in a 0-day window for ~10 months. MDM that lags Samsung monthly patches is the exposure.

What is confirmed vs not

CONFIRMED Unit 42 family, CVE, device list, region.

ASSESSED zero-click (Unit 42 “likely”).

UNKNOWN which vendor sold the implant.

What defenders should do

Galaxy fleet: April 2025+ image-processing patch is mandatory, not optional.
High-risk personnel: assume mic/camera compromise in that window.
Do not hunt this as WhatsApp’s CVE.

RWP assessment

Confidence: High on Unit 42. Brief as CSV-class spyware, not “Android virus.”