Kaspersky’s analysis indicates that the earliest signs of infection occurred in 2019, and the most recent version of iOS affected by the malicious toolset is 15.7. However, it should be noted that the latest major iOS release, version 16.5, may have already addressed the vulnerability exploited by the malware.

Malicious encrypted attachment (Kaspersky)

The exploit, delivered via iMessage, triggers an unknown vulnerability in iOS, allowing for code execution and the fetching of subsequent stages from the attackers’ server. This includes privilege escalation exploits.

Kaspersky has shared a list of 15 domains associated with this malicious activity, enabling security administrators to check historical DNS logs for any potential signs of exploitation on their devices.

Network exploitation sequence (Kaspersky)

Once the malware achieves root privilege escalation, it downloads a fully-featured toolset that executes commands to gather system and user information. Additionally, it can download additional modules from the command and control (C2) server.

Notably, the APT toolset dropped on the device lacks persistence mechanisms, meaning a simple reboot would effectively halt its operations.

While Kaspersky has shared some details about the malware’s functions, the analysis of the final payload is still underway, limiting the available information.

Russia accusations 

In a coinciding statement, Russia’s FSB intelligence and security agency accused Apple of deliberately providing the NSA with a backdoor that enables the infection of iPhones in Russia with spyware. The FSB alleges that thousands of iPhones belonging to officials within the Russian government and staff from various embassies have been infected with malware.