[ad_1]
Russian Government Claims It Uncovered ‘Several Thousand’ Infections
![Kaspersky Discloses Apple Zero Click Malware](https://130e178e8f8ba617604b-8aedd782b7d22cfe0d1146da69a52436.ssl.cf1.rackcdn.com/kaspersky-discloses-apple-zero-click-malware-showcase_image-5-a-22214.jpg)
Russian cybersecurity firm Kaspersky says it uncovered zero click malware infecting staffers’ iPhones on the same day the Kremlin claim it uncovered a “reconnaissance operation by American intelligence agencies.”
See Also: Live Webinar | Education Cybersecurity Best Practices: Devices, Ransomware, Budgets and Resources
Kaspersky in a Thursday blog post, says the malware has been active at least since 2019 and infects devices with an iMessage attachment that automatically triggers code execution. Kaspersky calls the campaign behind the malware “Operation Triangulation.”
Russian domestic intelligence agency the Federal Security Service says it uncovered several thousand iPhone infected with the same malware and accused Apple of collaborating with U.S. National Security Agency.
The malware exfiltrates data including microphone recordings, photos from instant messaging apps, geolocation and other sensitive data. The Russian National Coordination Center for Computer Incidents issued a bulletin listing the same set of 15 malware command and control domains that Kaspersky identified.
Apple, which has a well-documented history of defying U.S. government attempts to weaken its security, issued a terse statement.
“We have never worked with any government to insert a backdoor into any Apple product and never will,” an Apple spokesperson said.
The smartphone giant also noted that Kaspersky reported the malware doesn’t work past the iOS 15.7 iPhone operating system. Apple introduced iOS 16 to the public last September.
A Kaspersky spokesperson said the company determined one of the vulnerabilities used by the malware was CVE-2022-46690, an out-of-bounds write issue patched in December.
The security firm noticed the attack after employees’ devices began to exhibit suspicious behavior including an inability to download iOS updates, which it says is a common indicator of compromise.
“The spyware managed to infect several dozen iPhones of our employees,” Eugene Kaspersky, the founder of the security firm tweeted. The malware appears distinct from known commercial spyware apps such as Pegasus, Predator or Reign, he also tweeted.
The CEO also said he’s “confident that Kaspersky was not the main target of this cyberattack.” The cybersecurity company has long provoked national security concerns in the United States culminating in its March 2022 inclusion onto a Federal Communications Commission blacklist preventing recipients of telecom subsidiaries from spending federal dollars on its products. Congress prohibited federal agencies from contracting with Kaspersky since 2018.
The Kremlin reportedly told officials involved in preparations for Russia’s 2024 presidential elections in March to stop from using iPhones, citing the potential for Western surveillance.
Kaspersky is currently reviewing the attack tactics in details and says it will disclose more details on the vulnerability and the malware strain in coming days.
Kaspersky researchers analysis states that the “single most reliable indicator” of the malware infection is the presence of a process named “BackupAgent.”
That binary is deprecated, researchers say. “However, it is important to note that there is also a binary named “BackupAgent2”, and that is not an indicator of compromise.”
With reporting by ISMG’s David Perera in Washington, D.C.
[ad_2]
Source link