10.06.2025 09:10
Before the Assad regime collapsed in Syria, it was revealed that spyware had infiltrated the smartphones of thousands of regime officers. Many officers of the Assad regime were caught in this operation, but it is unknown which country or institution carried it out.
Supporters of Turkey-backed opposition groups initiated operations against the Assad regime approximately 5 months before the actual launch. According to confessions from a former officer loyal to Assad, a practice believed to be a 'donation to officers' began circulating among regime officers in June 2024.
THE FOUNDATION OF ASMA ASSAD WAS IMITATED
Through a mobile application named 'Syria Trust for Development (STFD)', which appeared to belong to the so-called humanitarian organization 'Syria Development Foundation' known to be supported by Bashar Assad's wife, Asma Assad, payments were made under the guise of donations to officers serving in the Syrian army.
The application, prepared using the foundation's name and logo, also had a user-friendly interface that instilled trust in users. The application could be downloaded from an unofficial Telegram channel opened in the name of the Syria Development Foundation.
THEY GAVE THEIR PERSONAL INFORMATION WITH THEIR OWN HANDS
This mobile application began to spread rapidly among officers. Users who downloaded the application entered their personal information on an external website they were directed to. However, using a common social engineering method known as 'Phishing', which was embedded in their websites, all the entered information was captured.
THEY GAINED THE TRUST OF OFFICERS THANKS TO ASMA ASSAD
According to a report in Sabah; what made the application trustworthy was that it imitated a foundation supported by Asma Assad. The developers of the application knew that no one would dare to question the financial traffic of an application supported by Asma Assad, taking advantage of the oppressive attitude of the Assad regime.
Moreover, the application's public accessibility, ease of access, and the presence of questions in the sections to be filled out, such as "What kind of assistance do you expect?" and "Can you provide us with information about your financial situation?" ensured that there were no doubts about the application.
THEY CREATED A 'MAP' OF REGIME OFFICERS
Officers requesting financial assistance under the name of 'donation' entered many pieces of information that should remain confidential, including their identities, family information, and critical positions they held in the army. Thus, the person or institution that developed the application created a map of the Regime Army using information belonging to commanders in high-ranking positions, communication, and intelligence officers in the Syrian Army.
PHONES STARTED TO BE MONITORED WITH SPY SOFTWARE
Later, the second phase of the operation was initiated, and SpyMax, one of the popular Android surveillance tools, was secretly installed on the officers' phones.
As a result, many sensitive information, including the officers' microphones, cameras, messages, galleries, and even real-time locations, could now be monitored. This spyware, believed to have spread through APK files, provided the Assad Army with dynamic intelligence regarding the current situation.
WHO CONDUCTED THE OPERATION?
The confidentiality of which country, institution, or individuals carried out this professionally conducted and undetectable comprehensive cyber espionage operation remains intact. While the exact number of targeted regime officers is unknown, it is reported to be at least 1,500.