Trusted Design

YiSpecter: iOS Malware That Attacks Non-jailbroken Apple devices

概要

YiSpecter is different from previously seen iOS malware in that it attacks both jailbroken and non-jailbroken iOS devices through unique and harmful malicious behaviors. Specifically, it’s the first malware we’ve seen in the wild that abuses private APIs in the iOS system to implement malicious functionalities. So far, the malware primarily affects iOS users in mainland China and Taiwan. It spreads via unusual means, including the hijacking of traffic from nationwide ISPs, an SNS worm on Windows, and an offline app installation and community promotion. Many victims have discussed YiSpecter infections of their jailbroken and non-jailbroken iPhones in online forums and have reported the activity to Apple. The malware has been in the wild for over 10 months, but out of 57 security vendors in VirusTotal, only one is detecting the malware at the time of this writing.

Created: 2026-02-23

Indicators

類似Pulses

このPulseに関連する脅威アクター (事実ベース)

Winnti Group

Score: 3.29
Matched TTPs:
  • T1499.001 - OS Exhaustion Flood
MITREへのリンク →

APT41

Score: 9.18
Matched TTPs:
  • T1499.001 - OS Exhaustion Flood
  • T1140 - Deobfuscate/Decode Files or Information
  • T1573 - Encrypted Channel
  • T1218.010 - Regsvr32
MITREへのリンク →

Rocke

Score: 10.86
Matched TTPs:
  • T1499.001 - OS Exhaustion Flood
  • T1140 - Deobfuscate/Decode Files or Information
  • T1535 - Unused/Unsupported Cloud Regions
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

TeamTNT

Score: 8.70
Matched TTPs:
  • T1499.001 - OS Exhaustion Flood
  • T1091 - Replication Through Removable Media
  • T1535 - Unused/Unsupported Cloud Regions
MITREへのリンク →

APT28

Score: 24.75
Matched TTPs:
  • T1499.001 - OS Exhaustion Flood
  • T1058 - Service Registry Permissions Weakness
  • T1140 - Deobfuscate/Decode Files or Information
  • T1218.010 - Regsvr32
  • T1146 - Clear Command History
  • T1105 - Ingress Tool Transfer
  • T1055.008 - Ptrace System Calls
  • T1566.003 - Spearphishing via Service
MITREへのリンク →

UNC3886

Score: 15.43
Matched TTPs:
  • T1499.001 - OS Exhaustion Flood
  • T1140 - Deobfuscate/Decode Files or Information
  • T1021.006 - Windows Remote Management
  • T1136.002 - Domain Account
  • T1218.010 - Regsvr32
  • T1578.001 - Create Snapshot
MITREへのリンク →

Mustard Tempest

Score: 6.51
Matched TTPs:
  • T1682 - Query Public AI Services
  • T1091 - Replication Through Removable Media
MITREへのリンク →

Gamaredon Group

Score: 8.85
Matched TTPs:
  • T1058 - Service Registry Permissions Weakness
  • T1091 - Replication Through Removable Media
  • T1562.010 - Downgrade Attack
MITREへのリンク →

LuminousMoth

Score: 10.13
Matched TTPs:
  • T1058 - Service Registry Permissions Weakness
  • T1091 - Replication Through Removable Media
  • T1136.002 - Domain Account
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

Aoqin Dragon

Score: 4.53
Matched TTPs:
  • T1058 - Service Registry Permissions Weakness
  • T1218.010 - Regsvr32
MITREへのリンク →

Darkhotel

Score: 7.12
Matched TTPs:
  • T1058 - Service Registry Permissions Weakness
  • T1218.010 - Regsvr32
  • T1578.001 - Create Snapshot
MITREへのリンク →

Mustang Panda

Score: 13.30
Matched TTPs:
  • T1058 - Service Registry Permissions Weakness
  • T1091 - Replication Through Removable Media
  • T1218.010 - Regsvr32
  • T1055.005 - Thread Local Storage
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

FIN7

Score: 17.33
Matched TTPs:
  • T1058 - Service Registry Permissions Weakness
  • T1091 - Replication Through Removable Media
  • T1140 - Deobfuscate/Decode Files or Information
  • T1573 - Encrypted Channel
  • T1105 - Ingress Tool Transfer
  • T1578.001 - Create Snapshot
  • T1490 - Inhibit System Recovery
MITREへのリンク →

Tropic Trooper

Score: 9.86
Matched TTPs:
  • T1058 - Service Registry Permissions Weakness
  • T1218.010 - Regsvr32
  • T1105 - Ingress Tool Transfer
  • T1490 - Inhibit System Recovery
MITREへのリンク →

Sandworm Team

Score: 15.55
Matched TTPs:
  • T1091 - Replication Through Removable Media
  • T1005 - Data from Local System
  • T1140 - Deobfuscate/Decode Files or Information
  • T1187 - Forced Authentication
  • T1573 - Encrypted Channel
  • T1218.010 - Regsvr32
MITREへのリンク →

TA2541

Score: 4.43
Matched TTPs:
  • T1091 - Replication Through Removable Media
  • T1136.002 - Domain Account
MITREへのリンク →

Earth Lusca

Score: 5.90
Matched TTPs:
  • T1091 - Replication Through Removable Media
  • T1140 - Deobfuscate/Decode Files or Information
  • T1136.002 - Domain Account
MITREへのリンク →

Kimsuky

Score: 6.11
Matched TTPs:
  • T1091 - Replication Through Removable Media
  • T1140 - Deobfuscate/Decode Files or Information
  • T1490 - Inhibit System Recovery
MITREへのリンク →

OilRig

Score: 7.31
Matched TTPs:
  • T1091 - Replication Through Removable Media
  • T1005 - Data from Local System
  • T1218.010 - Regsvr32
MITREへのリンク →

LazyScripter

Score: 4.43
Matched TTPs:
  • T1091 - Replication Through Removable Media
  • T1136.002 - Domain Account
MITREへのリンク →

Threat Group-3390

Score: 7.86
Matched TTPs:
  • T1091 - Replication Through Removable Media
  • T1140 - Deobfuscate/Decode Files or Information
  • T1573 - Encrypted Channel
  • T1218.010 - Regsvr32
MITREへのリンク →

TA505

Score: 4.43
Matched TTPs:
  • T1091 - Replication Through Removable Media
  • T1136.002 - Domain Account
MITREへのリンク →

BlackByte

Score: 7.29
Matched TTPs:
  • T1091 - Replication Through Removable Media
  • T1140 - Deobfuscate/Decode Files or Information
  • T1562.010 - Downgrade Attack
MITREへのリンク →

BITTER

Score: 3.47
Matched TTPs:
  • T1091 - Replication Through Removable Media
  • T1218.010 - Regsvr32
MITREへのリンク →

APT32

Score: 8.80
Matched TTPs:
  • T1091 - Replication Through Removable Media
  • T1218.010 - Regsvr32
  • T1105 - Ingress Tool Transfer
  • T1490 - Inhibit System Recovery
MITREへのリンク →

Saint Bear

Score: 3.47
Matched TTPs:
  • T1091 - Replication Through Removable Media
  • T1218.010 - Regsvr32
MITREへのリンク →

Moonstone Sleet

Score: 4.90
Matched TTPs:
  • T1091 - Replication Through Removable Media
  • T1573 - Encrypted Channel
MITREへのリンク →

Contagious Interview

Score: 9.95
Matched TTPs:
  • T1091 - Replication Through Removable Media
  • T1021.006 - Windows Remote Management
  • T1562.010 - Downgrade Attack
MITREへのリンク →

EXOTIC LILY

Score: 3.47
Matched TTPs:
  • T1091 - Replication Through Removable Media
  • T1218.010 - Regsvr32
MITREへのリンク →

Ember Bear

Score: 9.27
Matched TTPs:
  • T1005 - Data from Local System
  • T1140 - Deobfuscate/Decode Files or Information
  • T1136.002 - Domain Account
  • T1218.010 - Regsvr32
MITREへのリンク →

Volt Typhoon

Score: 10.43
Matched TTPs:
  • T1140 - Deobfuscate/Decode Files or Information
  • T1535 - Unused/Unsupported Cloud Regions
  • T1578.001 - Create Snapshot
  • T1569.002 - Service Execution
MITREへのリンク →

BackdoorDiplomacy

Score: 3.93
Matched TTPs:
  • T1140 - Deobfuscate/Decode Files or Information
  • T1136.002 - Domain Account
MITREへのリンク →

GOLD SOUTHFIELD

Score: 4.40
Matched TTPs:
  • T1140 - Deobfuscate/Decode Files or Information
  • T1573 - Encrypted Channel
MITREへのリンク →

FIN13

Score: 7.06
Matched TTPs:
  • T1140 - Deobfuscate/Decode Files or Information
  • T1105 - Ingress Tool Transfer
  • T1569.002 - Service Execution
MITREへのリンク →

Magic Hound

Score: 5.31
Matched TTPs:
  • T1140 - Deobfuscate/Decode Files or Information
  • T1187 - Forced Authentication
MITREへのリンク →

Medusa Group

Score: 9.63
Matched TTPs:
  • T1140 - Deobfuscate/Decode Files or Information
  • T1216 - System Script Proxy Execution
  • T1094 - Custom Command and Control Protocol
MITREへのリンク →

Sea Turtle

Score: 5.63
Matched TTPs:
  • T1140 - Deobfuscate/Decode Files or Information
  • T1218.010 - Regsvr32
  • T1490 - Inhibit System Recovery
MITREへのリンク →

Storm-0501

Score: 4.91
Matched TTPs:
  • T1140 - Deobfuscate/Decode Files or Information
  • T1535 - Unused/Unsupported Cloud Regions
MITREへのリンク →

APT29

Score: 5.63
Matched TTPs:
  • T1140 - Deobfuscate/Decode Files or Information
  • T1218.010 - Regsvr32
  • T1490 - Inhibit System Recovery
MITREへのリンク →

Dragonfly

Score: 5.89
Matched TTPs:
  • T1140 - Deobfuscate/Decode Files or Information
  • T1573 - Encrypted Channel
  • T1218.010 - Regsvr32
MITREへのリンク →

Play

Score: 4.14
Matched TTPs:
  • T1140 - Deobfuscate/Decode Files or Information
  • T1490 - Inhibit System Recovery
MITREへのリンク →

HAFNIUM

Score: 10.93
Matched TTPs:
  • T1140 - Deobfuscate/Decode Files or Information
  • T1105 - Ingress Tool Transfer
  • T1055.008 - Ptrace System Calls
  • T1490 - Inhibit System Recovery
MITREへのリンク →

APT39

Score: 4.40
Matched TTPs:
  • T1140 - Deobfuscate/Decode Files or Information
  • T1569.002 - Service Execution
MITREへのリンク →

MoustachedBouncer

Score: 4.54
Matched TTPs:
  • T1055.003 - Thread Execution Hijacking
MITREへのリンク →

Scattered Spider

Score: 5.90
Matched TTPs:
  • T1535 - Unused/Unsupported Cloud Regions
  • T1136.002 - Domain Account
MITREへのリンク →

Andariel

Score: 7.80
Matched TTPs:
  • T1136.002 - Domain Account
  • T1187 - Forced Authentication
  • T1218.010 - Regsvr32
MITREへのリンク →

Turla

Score: 10.65
Matched TTPs:
  • T1136.002 - Domain Account
  • T1578.001 - Create Snapshot
  • T1569.002 - Service Execution
  • T1490 - Inhibit System Recovery
MITREへのリンク →

Lazarus Group

Score: 21.97
Matched TTPs:
  • T1069.001 - Local Groups
  • T1218.010 - Regsvr32
  • T1055.005 - Thread Local Storage
  • T1105 - Ingress Tool Transfer
  • T1578.001 - Create Snapshot
  • T1569.002 - Service Execution
  • T1216 - System Script Proxy Execution
MITREへのリンク →

Cobalt Group

Score: 4.42
Matched TTPs:
  • T1573 - Encrypted Channel
  • T1218.010 - Regsvr32
MITREへのリンク →

Sidewinder

Score: 4.09
Matched TTPs:
  • T1218.010 - Regsvr32
  • T1578.001 - Create Snapshot
MITREへのリンク →

The White Company

Score: 4.09
Matched TTPs:
  • T1218.010 - Regsvr32
  • T1578.001 - Create Snapshot
MITREへのリンク →

Higaisa

Score: 7.01
Matched TTPs:
  • T1218.010 - Regsvr32
  • T1578.001 - Create Snapshot
  • T1569.002 - Service Execution
MITREへのリンク →

APT37

Score: 5.12
Matched TTPs:
  • T1218.010 - Regsvr32
  • T1216 - System Script Proxy Execution
MITREへのリンク →

BRONZE BUTLER

Score: 4.09
Matched TTPs:
  • T1218.010 - Regsvr32
  • T1578.001 - Create Snapshot
MITREへのリンク →

Transparent Tribe

Score: 4.16
Matched TTPs:
  • T1218.010 - Regsvr32
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

Equation

Score: 4.13
Matched TTPs:
  • T1130 - Install Root Certificate
MITREへのリンク →

Strider

Score: 7.06
Matched TTPs:
  • T1130 - Install Root Certificate
  • T1569.002 - Service Execution
MITREへのリンク →

Velvet Ant

Score: 9.73
Matched TTPs:
  • T1569.002 - Service Execution
  • T1490 - Inhibit System Recovery
  • T1566.003 - Spearphishing via Service
MITREへのリンク →

APT38

Score: 3.62
Matched TTPs:
  • T1216 - System Script Proxy Execution
MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

APT28

Score: 0.80
Matched TTPs:
  • T1140 - Deobfuscate/Decode Files or Information
  • T1499.001 - OS Exhaustion Flood
  • T1218.010 - Regsvr32
  • T1058 - Service Registry Permissions Weakness
  • T1566.003 - Spearphishing via Service
  • T1055.008 - Ptrace System Calls
  • T1105 - Ingress Tool Transfer
  • T1146 - Clear Command History
MITREへのリンク →

Lazarus Group

Score: 0.72
Matched TTPs:
  • T1055.005 - Thread Local Storage
  • T1578.001 - Create Snapshot
  • T1216 - System Script Proxy Execution
  • T1069.001 - Local Groups
  • T1218.010 - Regsvr32
  • T1569.002 - Service Execution
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

FIN7

Score: 0.64
Matched TTPs:
  • T1578.001 - Create Snapshot
  • T1140 - Deobfuscate/Decode Files or Information
  • T1573 - Encrypted Channel
  • T1058 - Service Registry Permissions Weakness
  • T1091 - Replication Through Removable Media
  • T1490 - Inhibit System Recovery
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

UNC3886

Score: 0.58
Matched TTPs:
  • T1578.001 - Create Snapshot
  • T1021.006 - Windows Remote Management
  • T1140 - Deobfuscate/Decode Files or Information
  • T1499.001 - OS Exhaustion Flood
  • T1136.002 - Domain Account
  • T1218.010 - Regsvr32
MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ


← Pulse一覧に戻る