Apple iOS users served mobile malware in Poisoned News campaign

guest · Mar 26, 2020

Apple iOS users served mobile malware in Poisoned News campaign
March 26, 2020
https://www.zdnet.com/article/apple...-malware-in-operation-poisoned-news-campaign/

Apple iOS smartphone users in Hong Kong are being targeted in a new campaign exploiting online news readers to serve malware.

This week, Trend Micro researchers said the scheme, dubbed Operation Poisoned News, uses links posted on a variety of forums popular with Hong Kong residents that claim to lead to news stories.
The links do actually lead to legitimate news outlets; however, a watering hole attack (.PDF) uses a hidden iframe to deploy and execute malicious code.

"The only visible iframe leads to a legitimate news site, which makes people believe they are visiting the said site. One invisible iframe was used for website analytics; the other led to a site hosting the main script of the iOS exploits."
If a user clicks on a link and is using an Apple iPhone 6S up to the iPhone X running iOS 12.1 and 12.2 that has not received a silent patch for a Safari bug Apple has fixed in recent versions of the firm's OS, this begins an infection chain.
Click to expand...

The second stage of the attack chain is the deployment of a new form of iOS malware called lightSpy, a modular backdoor that gives operators the option to remotely execute shell commands and manipulate files on the victim device.

It is believed the threat actors behind the Poisoned News campaign are connected to, or are the same, as the operators of dmsSpy, an Android variant of the same malware that has been distributed through open Telegram channels since 2019.
Click to expand...

Trend Micro: Operation Poisoned News: Hong Kong Users Targeted With Mobile Malware via Local News Links
Technical Brief (PDF - 10.03 MB): https://documents.trendmicro.com/assets/Tech-Brief-Operation-Poisoned-News-Hong-Kong-Users-Targeted-with-Mobile-Malware-via-Local-News-Links.pdf

guest · Mar 26, 2020

Kaspersky: iOS exploit chain deploys LightSpy feature-rich malware

A watering hole was discovered on January 10, 2020 utilizing a full remote iOS exploit chain to deploy a feature-rich implant named LightSpy. The site appears to have been designed to target users in Hong Kong based on the content of the landing page. Since the initial activity, we released two private reports exhaustively detailing spread, exploits, infrastructure and LightSpy implants.
[...]
Conclusion
This particular framework and infrastructure is an interesting example of an agile approach to developing and deploying surveillance framework in Southeast Asia. This innovative approach is something we have seen before from SpringDragon, and LightSpy targeting geolocation at least falls within previous regional targeting of SpringDragon/LotusBlossom/Billbug APT, as does infrastructure and “evora” backdoor use.
Click to expand...

guest · Mar 26, 2020

Emerging APT Mounts Mass iPhone Surveillance Campaign
The malware, the work of a new APT called TwoSail Junk, allows deep surveillance and total control over iOS devices
March 26, 2020
https://threatpost.com/emerging-apt-mounts-mass-iphone-surveillance-campaign/154192/

A recently discovered, mass-targeted watering-hole campaign has been aiming at Apple iPhone users in Hong Kong – infecting website visitors with a newly developed custom surveillance malware. The bad code – the work of a new APT called “TwoSail Junk” – is delivered via a multistage exploit chain that targets iOS vulnerabilities in versions 12.1 and 12.2 of Apple’s operating system, according to researchers.

Watering-hole campaigns make use of malicious websites that lure visitors in with targeted content – cyberattackers often post links to that content on discussion boards and on social media to cast a wide net.
When visitors click through to a malicious website, background code will then infect them with malware.
Click to expand...

“This aims to compromise as many mobile devices as possible for device-backdooring and surveillance,” according to Trend Micro.
“Both ours and previous reporting from others have documented TwoSail Junk’s less precise and broad use of forum posts and replies,” Kaspersky researchers, who identified the threat actor as the TwoSail Junk APT, noted.
Atrribution
While Kaspersky is calling the APT group behind the effort “TwoSail Junk,” researchers there said that the operators are likely tied to other, well-known threat actors.
“We have hints from known backdoor callbacks to infrastructure about clustering this campaign with previous activity,” according to the firm’s analysis.

For its part, Trend Micro researchers agree that the evidence points to a sophisticated attacker.
He added that while the campaign, which Trend Micro calls Operation Poison News, is focused on Hong Kong for now, investigations are ongoing into the operators’ future plans. Kaspersky also said that there’s evidence that other versions of the backdoor are under development.
Click to expand...

Log in or Sign up

Apple iOS users served mobile malware in Poisoned News campaign

guest Guest

guest Guest

guest Guest

Log in or Sign up

Apple iOS users served mobile malware in Poisoned News campaign

guest Guest

guest Guest

guest Guest

Useful Searches