{"id":56443,"date":"2023-06-05T14:32:57","date_gmt":"2023-06-05T06:32:57","guid":{"rendered":"http:\/\/www.upgrademag.com\/web\/?p=56443"},"modified":"2023-06-05T14:32:59","modified_gmt":"2023-06-05T06:32:59","slug":"kaspersky-reports-on-new-mobile-apt-campaign-targeting-ios-devices","status":"publish","type":"post","link":"http:\/\/www.upgrademag.com\/web\/2023\/06\/05\/kaspersky-reports-on-new-mobile-apt-campaign-targeting-ios-devices\/","title":{"rendered":"Kaspersky reports on new mobile APT campaign targeting iOS devices"},"content":{"rendered":"\n

Kaspersky researchers have uncovered<\/a> an ongoing mobile Advanced Persistent Threat (APT) campaign targeting iOS devices with previously unknown malware. Dubbed as \u201cOperation Triangulation\u201d, the campaign distributes zero-click exploits via iMessage to run malware gaining complete control over the device and user data, with the final goal to spy on users.<\/strong><\/p>\n\n\n\n

Kaspersky experts have uncovered<\/a> a new mobile APT campaign while monitoring the network traffic of its corporate Wi-Fi network using the Kaspersky Unified Monitoring and Analysis Platform (KUMA). Upon further analysis, company researchers discovered the threat actor has been targeting iOS devices of dozens of company employees. <\/p>\n\n\n\n

The investigation of the attack technique is still ongoing, but so far Kaspersky researchers were able to identify the general infection sequence. The victim received a message via iMessage with an attachment containing a zero-click exploit. Without any further interaction, the message triggered a vulnerability that led to code execution for privilege escalation and provided full control over the infected device. Once the attacker successfully established its presence in the device, the message was automatically deleted.<\/p>\n\n\n\n

Further, the spyware quietly transmitted private information to remote servers: including microphone recordings, photos from instant messengers, geolocation and data about a number of other activities of the owner of the infected device.<\/p>\n\n\n\n

During the analysis, it was confirmed that there was no impact on the company\u2019s products, technologies and services, and no Kaspersky customer user data or critical company processes were affected. The attackers could only access data stored on the infected devices. Although not certain, it is believed that the attack was not targeted specifically at Kaspersky \u2013 the company\u2019s just first to discover it. The following days will likely bring more clarity about the global exposure of this cyberattack.<\/p>\n\n\n\n

\u201cWhen it comes to cybersecurity, even the most secure operating systems can be compromised. As APT actors are constantly evolving their tactics and searching for new weaknesses to exploit, businesses must prioritize security of their systems. This involves prioritizing employee education and awareness, and providing them with the latest threat intelligence and tools to effectively recognize and defend against potential threats,\u201d commented Igor Kuznetsov, head of the EEMEA unit at Kaspersky Global Research and Analysis Team (GReAT). <\/p>\n\n\n\n

\u201cOur investigation of the Triangulation operation continues. We expect further details on it to be shared soon, as there can be targets of this spy operation outside Kaspersky,\u201d added Kuznetsov.<\/p>\n\n\n\n

Learn more about \u201cOperation Triangulation\u201d on Securelist.com<\/a>.<\/p>\n\n\n\n

To check if your iOS device is infected or not, follow instructions on the website.<\/p>\n\n\n\n

In order to avoid falling victim to a targeted attack by a known or unknown threat actor, Kaspersky researchers recommend implementing the following measures:<\/p>\n\n\n\n