Flash Alert: Pegasus Malware Targets High-Profile Victims in Zero-Click Attacks

TLP: GREEN

On July 18, 2021, the non-profit organization, Forbidden Stories, published an article that detailed the targeting of high-profile individuals with spyware malware, after investigating a data leak that contained over 50,000 phone numbers of possible targets. The malware, called Pegasus, was developed by the Israel-based technology firm NSO Group, and is used to monitor all incoming and outgoing traffic from targeted devices. This includes, but is not limited to, tracking keystrokes, recording audio and video, monitoring device logs, and collecting data from applications. Pegasus utilized a "zero-click" attack vector which involves a set of exploits used to target fully patched mobile devices, such as an Apple iPhone 12 running iOS 14.6 in July 2021.

Standing Intelligence Requirements

Malware DDW

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

MITRE ATT&CK

ATT&CK Framework ATT&CK Framework Cont

Recommendations

The use of zero-click technology enables the malware to execute on the target device without user interaction, making it difficult to detect and prevent. If suspicious activity is observed on a device, report this activity to the appropriate security teams.
Previous Pegasus attacks involved malicious links in text messages via social engineering lures. Avoid clicking on suspicious links in text messages and emails from unknown contacts and instead report such activity to the appropriate security teams.
Although Pegasus is a highly-targeted type of spyware, it is recommended to understand the malware's tactics, techniques, and procedures (TTPs), and continue following approved cybersecurity practices.

Details

Headlines about Pegasus spyware broke on July 18, 2021, after media organizations investigated a massive data leak containing over 50,000 phone numbers of individuals who were possible persons of interest for NSO Group clients. Media investigations identified over 1,000 phone numbers belonging to individuals in over 50 countries. This group included high-profile targets such as journalists, activists, politicians, and world leaders, as well as friends and relatives of some of these targets.

Amnesty International performed a forensic analysis of Pegasus attacks from 2014 to 2021, primarily focusing on the forensic traces from iOS and Android devices. When Pegasus first emerged in reports, the malware used social engineering to initiate the spyware on the target device. In one example that occurred in 2016, Pegasus was associated with an attack on a target which involved suspicious text messages containing malicious links. When clicked, the link would trigger a chain of exploits to remotely "jailbreak" (a privilege escalation to remove software restrictions on Apple devices) the iPhone and install Pegasus. After the installation, the spyware would monitor and collect all incoming and outgoing data from the phone. Some of these actions may include:

Collecting keystrokes
Recording audio and video
Extracting phone call logs
Monitoring communications (email, text messages, etc.)
Enabling and tracking geolocation
Monitoring network configurations and device settings
Monitoring other applications installed on the target device (ZeroFox Note: This includes bypassing security settings for encrypted chat applications.)

In the most recent investigation of the Pegasus spyware performed by the non-profit organizations, the malware uses a zero-click attack vector. This type of attack vector does not require any user interaction from the target to compromise the device. In Amnesty International's forensic analysis, the investigation revealed that Pegasus exploits successfully infected fully patched iPhone 12 devices running iOS 14.6 in July 2021. Although Apple uses robust security measures for their digital devices, it does not mean that Apple devices are immune from cyber attacks and security vulnerabilities, as demonstrated by the zero-click attacks. Zero-click attacks were also used by NSO Group in 2019 by exploiting iOS iMessage and FaceTime applications, and later in 2020 via the Apple Music application.

Amnesty International compiled a list of indicators of compromise (IOCs) via forensic analysis on known Pegasus attacks. The list contains references to network injections, malicious processes, and affected mobile applications. Additionally, Amnesty researchers uploaded a GitHub repository containing IOCs for domain names from Pegasus versions 1 through 4, email addresses, files, and processes identified in Pegasus attacks.

IOC Sources

https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/ https://github.com/AmnestyTech/investigations/tree/master/2021-07-18_nso