Update on May 23, 2024
We asked both users if we could share a bit more info and after seeing what we posted yesterday, both gave permission.
One is in the pharmaceutical sector in France, other in manufacturing sector (user requested we not name the country). Neither user’s employer is involved with defence related activities and NO connection to manufacturing related to supplying Ukraine. It was one of the first questions we asked.
Both users felt that the threat actor is conducting intellectual property (IP) theft and not targeting them as individuals. Both work for organizations that face routine cyber attacks against their main corporate networks with the assumed primary motivations of attackers being IP theft plus the typical ransomware threat any large corporation faces.
Original Post
We recently detected new iOS spyware (we’re calling it “Vision”) on the devices of two users of our Am I Secure? app. We have user permission to share the following information.
Indicator of Compromise (IoC): /private/var/db/com.apple.xpc.roleaccountd.staging/visioniOS/
There is no legitimate subfolder like this, it is named this way to appear legitimate.
Two devices impacted, users both in Western Europe, one running iOS 17.4.1 at the time of detection and one running iOS 17.5. One iPhone 13 (17.4.1), one iPhone 15 Pro Max (17.5). Neither had Lockdown Mode enabled. No apparent connection between victims (not same industry, not same country, etc.). Victims are not journalists or activists. Neither felt they were a likely target of their own government but potentially of interest to a foreign government.
Very likely this threat actor can install on 17.5.1 as well since that update did not contain any security fixes.
The spyware does not appear to survive restart based on post-restart scanning. Re-exploitation was not observed. No copy of the spyware is currently available (not part of sysdiagnose submission) but one victim contacted law enforcement/government in their jurisdiction for further analysis and a full device backup + 24 hours of network traffic collection was performed before the device was rebooted (to detect command & control infrastructure). Other victim wiped the device upon being notified. Due to no copy yet of the implant, spyware family not yet identified.
The initial exploitation method not yet identified but both victims have multiple messenger apps installed with readily obtainable contact details tied to those messenger apps. Neither recalls any links recently received and neither travelled outside of their country (i.e. not using foreign ISPs or mobile providers where traffic could be modified). Both only had common popular apps installed.
If you want to check your device, create a sysdiagnose file now, don’t restart your device, allow 10-15 minutes for it to complete and then submit it via Am I Secure? for analysis.
Our Am I Secure? for Work product would have also detected these compromises.
