Apple iOS Now Targeted In Massive Cyber Espionage Campaign

Attack campaign tied to Russia now zeroing in on mobile users iPhones, iPads.

An extensive and sophisticated cyber espionage operation targeting mainly Western military, government, defense industry firms, and the media, now has a new weapon: a spyware app for Apple iPhones and iPads.
Operation Pawn Storm, which has been tied to Russia by at least one security research firm, is using a specially crafted iOS app to surreptitiously steal from the mobile device text messages, contact lists, pictures, geo-location information, WiFi status of the device, lists of installed apps and processes -- and to record voice conversations, according to new Trend Micro research.
The Cold War has returned in cyberspace, and Apple has become the gateway to western elites, says Tom Kellermann, chief cyber security officer with Trend Micro. Pawn Storm has evolved to now incorporate proximity attacks against Western victims.
Trend Micro researchers, who found the iOS malware while studying and tracking Operation Pawn, say they believe the Apple spyware gets installed on systems already compromised by the attackers. Its similar to the next-stage SEDINT malware they found targeting Microsoft Windows systems.
We found two malicious iOS applications in Operation Pawn Storm. One is called
XAgent
(detected as IOS_XAGENT.A) and the other one uses the name of a legitimate iOS game,
MadCap
(detected as IOS_ XAGENT.B). After analysis, we concluded that both are applications related to SEDNIT, wrote Trend mobile threat analysts Lambert Sun and Brooks Hong and senior threat researcher Feike Hacquebord, in a blog post today.
The obvious goal of the SEDNIT-related spyware is to steal personal data, record audio, make screenshots, and send them to a remote command-and-control (C&C) server. As of this publishing, the C&C server contacted by the iOS malware is live, they said.
When XAgent runs on iOS 7, its icon doesnt show up on the mobile device. Its hard to kill, too: When the researchers attempted to terminate the apps process, it restarted right away. When running on iOS 8, however, the icon is not hidden and doesnt automatically restart after its killed. The researchers say this shows the malware was created before iOS 8s release in September of last year.
We can see that the code structure of the malware is very organized. The malware looks carefully maintained and consistently updated,
the researchers said.
Operation Pawn Storm
cyberattacks have intensified in the wake of US-Russian tensions, and the organizations and regions targeted appear to point to Russia or Russian interests. The attackers are going after the US, NATO allies, and Russian dissidents. Among the targets of some phishing attacks used in the campaign are ACADEMI (the US defense contractor formerly known as Blackwater), SAIC, and the Organization for Security and Cooperation in Europe.
Trend Micro so far has stopped short of attributing the attacks to Russia. Researchers at
FireEye, however, recently called out the Russian government as being behind the Operation Pawn Storm campaign--specifically the so-called APT28 hacking group
. This Russian government-backed type of espionage has been very mysterious and hard to nail down over all these years on the Internet, Dan McWhorter, lead researcher for the report and vice president of threat intelligence for FireEye, told Dark Reading in October. In my opinion after looking at our research, it confirms that yes, in fact, the Russian government is doing this, and it gives us a body of evidence to put against that assertion that wasn’t there previously.
Just how victims Apple iOS devices get infected with the spyware is unknown thus far. In one case, the researchers found a Tap Here to Install the Application prompt to lure users into installing the app. Another possible vector, they say, is via a compromised Windows laptop when the iPhone is connected to it with a USB cable. The attackers employ Apples ad-hoc provisioning method of distributing the app.

Last News
▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security	▸ Website hacks happened during World Cup final. ◂ Discovered: 23/12/2024 Category: security	▸ Criminal Possession of Government-Grade Stealth Malware ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Apple iOS Now Targeted In Massive Cyber Espionage Campaign