Apple Security Flaws Exposed in Sophisticated Spyware and Crypto Theft Attacks

Post Views: 102

US Agencies Ordered to Patch iOS Vulnerabilities Exploited in Crypto-Theft Attacks

The US Cybersecurity and Infrastructure Security Agency (CISA) has directed federal agencies to address three iOS security vulnerabilities that have been targeted in cyberespionage and cryptocurrency theft attacks.

The Coruna Exploit Kit

Coruna is a sophisticated exploit kit that provides threat actors with multiple capabilities, including Pointer Authentication Code (PAC) bypass, sandbox escape, and PPL (Page Protection Layer) bypass.

These capabilities enable attackers to gain WebKit remote code execution and escalate permissions to Kernel privileges on vulnerable devices.

The exploit kit has been used by multiple threat actors, including a suspected Russian state-backed hacking group and a financially motivated Chinese threat actor.

Crypto-Theft Attacks

The Chinese threat actor, in particular, has used Coruna to deliver a malware payload designed to steal cryptocurrency wallets from infected victims.

The attacks involved the deployment of fake gambling and cryptocurrency websites that exploited the iOS vulnerabilities to gain access to victims’ devices.

CISA Response

CISA has added the three Coruna vulnerabilities to its catalog of Known Exploited Vulnerabilities and ordered Federal Civilian Executive Branch (FCEB) agencies to secure their devices by March 26.

The agency has also urged all organizations, including private sector companies, to prioritize patching these flaws to secure their devices against attacks.

“The Coruna exploit kit is an example of the increasing sophistication of spyware-grade capabilities that are being used by nation-state actors and mass-scale criminal operations.”

Recommendations

In response to the threat, CISA has advised organizations to apply mitigations per vendor instructions, follow applicable guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

The agency has also emphasized the importance of prioritizing patching these flaws to secure devices against attacks.

Conclusion

The use of the Coruna exploit kit in crypto-theft attacks highlights the ongoing threat posed by nation-state actors and financially motivated threat actors to mobile device security.

Organizations must remain vigilant and take proactive steps to secure their devices against these types of attacks.