Massive iPhone Breach: QuaDream’s KingsPawn Spyware Unleashed on Devices
In recent years, the threat of commercial spyware has become increasingly prevalent as more and more individuals and organizations seek to gain unauthorized access to sensitive information. One of the latest examples of this is the KingsPawn spyware, which has been developed by the Israel-based firm QuaDream. Through a brand-new zero-click vulnerability called ENDOFDAYS, this spyware is being utilised to infiltrate the iPhones of high-risk persons, such as journalists, NGO employees, and members of the political opposition.
The attackers responsible for this spyware campaign have been able to abuse a zero-day flaw in iPhone devices running iOS 1.4 to 14.4.2, which has enabled them to leverage backdated and invisible iCloud calendar invitations to initiate the attack. These invitations are sent to targeted iOS devices and get added to the victim’s calendar automatically, without any prompt or notification. By sending a specifically crafted invitation, attackers can inject XML data into the victim’s device, which then allows them to execute the ENDOFDAYS exploit without any interaction with the victim. This means that the entire attack stays hidden from the victim’s eyes.
What’s particularly concerning about the KingsPawn spyware is that the compromised devices belonged to victims in Central Asia, Europe, the Middle East, North America, and Southeast Asia. This suggests that the attackers behind the campaign are operating on a global scale, and that they are targeting high-risk individuals wherever they may be located.
To make matters worse, the KingsPawn spyware has been designed to self-destruct itself, which makes it difficult to detect and mitigate. It cleans out any tracks from the victims’ iPhones to avoid detection, and there are indications that some code could be used on Android devices as well. This means that it could potentially infect a wide range of devices, not just iPhones.
Given the seriousness of this threat, it’s important for iOS device users to take steps to protect themselves from spyware attacks. One option is to enable Lockdown Mode, which offers enhanced security for iOS devices. This mode prevents third-party apps from accessing data on the device, which can help to prevent spyware from being installed. Additionally, users should follow best practices such as enabling automatic software updates and using reliable anti-malware software to stay protected.
See more: Hacktivist Indonesia claims to have attacked 12k Indian websites
However, it’s also important to recognize that commercial spyware is a growing industry, and that the number of buyers is surging exponentially. This means that the threat is likely to continue to evolve and become more sophisticated over time. As a result, it’s important for individuals and organizations to stay vigilant and to take proactive steps to protect themselves from these types of attacks.
One of the challenges with commercial spyware is that it can be difficult to detect and attribute to a specific entity. In the case of the KingsPawn spyware, for example, the servers hosting the spyware are in various countries around the world, including Bulgaria, Ghana, the Czech Republic, Uzbekistan, Israel, Mexico, Singapore, Romania, UAE, and Hungary. This makes it difficult for law enforcement agencies to track down the attackers responsible for the campaign, and to hold them accountable for their actions.
See more: Latitude Group takes a stand against ransom demanded by cyber attackers
The discovery of the KingsPawn spyware is a sobering reminder of the growing threat posed by commercial spyware, and the need for individuals and organizations to take steps to protect themselves from these types of attacks. While it’s clear that the industry for commercial spyware is growing, there are steps that can be taken to mitigate the risks, including enabling Lockdown Mode, keeping software up-to-date, and using reliable anti-malware software. Ultimately, however, it will take a concerted effort from governments, law enforcement agencies, and the technology industry to address this growing threat and to hold those responsible accountable for their actions.
Author: Manjushree Gavitre
We hope you found article interesting. For more exclusive content follow us on Facebook, Twitter and LinkedIn
