08:40 AM
Connect Directly

Apple iOS Now Targeted In Massive Cyber Espionage Campaign

Attack campaign tied to Russia now zeroing in on mobile user's iPhones, iPads.

An extensive and sophisticated cyber espionage operation targeting mainly Western military, government, defense industry firms, and the media, now has a new weapon: a spyware app for Apple iPhones and iPads.

Operation Pawn Storm, which has been tied to Russia by at least one security research firm, is using a specially crafted iOS app to surreptitiously steal from the mobile device text messages, contact lists, pictures, geo-location information, WiFi status of the device, lists of installed apps and processes -- and to record voice conversations, according to new Trend Micro research.

"The Cold War has returned in cyberspace, and Apple has become the gateway to western elites," says Tom Kellermann, chief cyber security officer with Trend Micro. "Pawn Storm has evolved to now incorporate proximity attacks against Western victims."

Trend Micro researchers, who found the iOS malware while studying and tracking Operation Pawn, say they believe the Apple spyware gets installed on systems already compromised by the attackers. It's similar to the "next-stage" SEDINT malware they found targeting Microsoft Windows systems.

"We found two malicious iOS applications in Operation Pawn Storm. One is called XAgent (detected as IOS_XAGENT.A) and the other one uses the name of a legitimate iOS game, MadCap (detected as IOS_ XAGENT.B). After analysis, we concluded that both are applications related to SEDNIT," wrote Trend mobile threat analysts Lambert Sun and Brooks Hong and senior threat researcher Feike Hacquebord, in a blog post today.

"The obvious goal of the SEDNIT-related spyware is to steal personal data, record audio, make screenshots, and send them to a remote command-and-control (C&C) server. As of this publishing, the C&C server contacted by the iOS malware is live," they said.

When XAgent runs on iOS 7, its icon doesn't show up on the mobile device. It's hard to kill, too: When the researchers attempted to terminate the app's process, it restarted right away. When running on iOS 8, however, the icon is not hidden and doesn't automatically restart after it's killed. The researchers say this shows the malware was created before iOS 8's release in September of last year.

"We can see that the code structure of the malware is very organized. The malware looks carefully maintained and consistently updated," the researchers said.

Operation Pawn Storm cyberattacks have intensified in the wake of US-Russian tensions, and the organizations and regions targeted appear to point to Russia or Russian interests. The attackers are going after the US, NATO allies, and Russian dissidents. Among the targets of some phishing attacks used in the campaign are ACADEMI (the US defense contractor formerly known as Blackwater), SAIC, and the Organization for Security and Cooperation in Europe.

Trend Micro so far has stopped short of attributing the attacks to Russia. Researchers at FireEye, however, recently called out the Russian government as being behind the Operation Pawn Storm campaign--specifically the so-called APT28 hacking group. "This Russian government-backed type of espionage has been very mysterious and hard to nail down over all these years on the Internet," Dan McWhorter, lead researcher for the report and vice president of threat intelligence for FireEye, told Dark Reading in October.  "In my opinion after looking at our research, it confirms that yes, in fact, the Russian government is doing this, and it gives us a body of evidence to put against that assertion that wasn’t there previously."

Just how victims' Apple iOS devices get infected with the spyware is unknown thus far. In one case, the researchers found a "Tap Here to Install the Application" prompt to lure users into installing the app. Another possible vector, they say, is via a compromised Windows laptop when the iPhone is connected to it with a USB cable. The attackers employ Apple's "ad-hoc provisioning" method of distributing the app. 

Kelly Jackson Higgins is Executive Editor at She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
4/3/2015 | 12:40:00 AM
Nice article
Just wanted to compliment the author on a good article. Kudos.
User Rank: Apprentice
2/22/2015 | 10:03:33 AM
Re: "Gateway to Western Elites"?
I would tend to agree if the sought after data resides on those machines. The difficulty I'm having is with human behavior.
User Rank: Ninja
2/9/2015 | 10:24:25 AM
Re: "Gateway to Western Elites"?
"especially since DoD computers and similar are going to have so many lockdowns on them that this malware most likely would never get there in the first place" Ordinarily, I would tend to agree if the sought after data resides on those machines. The difficulty I'm having is with human behavior. It is a given that some government officials use public web services such as gmail, etc. in the performance of their official duties. How far of a stretch would it be to think that government officials use connected personal devices to access those public services, or for accessing anything else in their official capacity?
User Rank: Apprentice
2/8/2015 | 10:23:57 PM
Re: "Gateway to Western Elites"?
So on an Apple device, but only gets on through a Windows computer (probably jailbroken phones as well).  Not surprising.  Something they leave out though - how many devices might have this?  Guess it is probably a very small number, especially since DoD computers and similar are going to have so many lockdowns on them that this malware most likely would never get there in the first place.  So, this really isn't an Apple problem, or iOS problem at all.
User Rank: Strategist
2/5/2015 | 4:25:21 PM
"Gateway to Western Elites"?
For all my sanctimonious Apple user friends who wouldn't get security when I asked them to because they felt Apple isn't Microsoft, and Apple won't get attacked cause they are the "good" guys.

This one's for you folks
Register for Dark Reading Newsletters
White Papers
Current Issue
Five Emerging Security Threats - And What You Can Learn From Them
At Black Hat USA, researchers unveiled some nasty vulnerabilities. Is your organization ready?
Flash Poll
Containing Corporate Data on Mobile Devices
Containing Corporate Data on Mobile Devices
If youre still focused on securing endpoints, youve got your work cut out for you. WiFi network provider iPass surveyed 1,600 mobile workers and found that the average US employee carries three devices -- a smartphone, a computer, and a tablet or e-reader -- with more than 80% of them doing work on personal devices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
According to industry estimates, about a million new IT security jobs will be created in the next two years but there aren't enough skilled professionals to fill them. On top of that, there isn't necessarily a clear path to a career in security. Dark Reading Executive Editor Kelly Jackson Higgins hosts guests Carson Sweet, co-founder and CTO of CloudPassage, which published a shocking study of the security gap in top US undergrad computer science programs, and Rodney Petersen, head of NIST's new National Initiative for Cybersecurity Education.