IPhones targeted by unknown spyware

2:47:26

2023-06-04

524

Kaspersky security experts have discovered an exceptional and highly complex cyber-attack that exploits iPhones to spy on the company's employees, whether they are senior administrators or senior employees, and given the complexity of the attack, Kaspersky experts believe that they are not the only target of this campaign.

Kaspersky researchers said they discovered the attack when they noticed "suspicious activity in several iOS phones" while monitoring their companies' Wi-Fi network.

Executed using hidden iMessages with a malicious attachment, this attack exploits a number of vulnerabilities in the iOS operating system and is executed at the device level, installing spyware that requires no user action.

Furthermore, the spyware transmits private information to remote servers, including: microphone recordings, images from instant messaging applications, geographical location, and data about a number of other activities of the owner of the infected device.

This entire attack is carried out in a manner so quiet that it is difficult to detect, yet it was detected by Kaspersky experts using Kaspersky Unified Monitoring and Analysis Platform (KUMA), the original SIEM solution for information and event management.

The system detected suspicious activity in the network coming from iPhones, and the initial investigation showed that a number of employees' iPhones were hacked through the new and highly developed spying program, which the company called Operation Triangulation.

Due to the closed nature of iOS, there are no tools in the system to detect and remove this malware from infected smartphones. Therefore, you must resort to third-party tools to do so.

And if you are looking for evidence of the presence of the (Triangulation) program in your device, disabling the ability to update the iOS operating system is considered an initial indication, and to detect the program more accurately, you will need to take a backup copy of the device and examine it using a special tool.

The researchers said that they have not yet been able to find an effective way to remove the spyware without losing user data because the iOS update is prevented in infected devices, as this procedure can only be done by resetting infected phones to factory settings and installing the latest version of the operating system. But if the spyware is deleted from the device's memory after a reboot, Triangulation can re-infect through exploits in an older version of iOS.

Eugene Kaspersky, CEO of Kaspersky, explained in a post on the company's blog that this report on Operation Triangulation is just the beginning of the investigation into this complex attack. So far, they have published preliminary results of the analysis, but there is still a lot of work left.

He added: We are completely confident that Kaspersky was not the main target of this cyberattack. In the coming days, we will provide more details about the spread of the spyware around the world.”