Regular updates to Ghost were pushed out to these handsets by the administrator. The AFP, however, was able to infiltrate the release channel, with unspecified tech, and modify the updates to plant a backdoor.

“The administrator regularly pushed out software updates, just like the ones needed for normal mobile phones,” the AFP added. “But the AFP was able to modify those updates, which basically infected the devices, enabling the AFP to access the content on devices in Australia.”

When international partners, including the FBI, Europol and French Gendarmerie, Royal Canadian Mounted Police (RCMP), Swedish Police Authority, Dutch National Police, Irish Garda Síochána, and the Italian Central Directorate for Anti-Drug Service, started targeting Ghost under an Operation code-named OTF NEXT, AFP saw an opportunity to run a parallel local Operation (Kraken), especially after it developed a “covert solution to infiltrate Ghost.”