Trusted Design

YiSpecter: iOS Malware That Attacks Non-jailbroken Apple devices

概要

YiSpecter is different from previously seen iOS malware in that it attacks both jailbroken and non-jailbroken iOS devices through unique and harmful malicious behaviors. Specifically, it’s the first malware we’ve seen in the wild that abuses private APIs in the iOS system to implement malicious functionalities. So far, the malware primarily affects iOS users in mainland China and Taiwan. It spreads via unusual means, including the hijacking of traffic from nationwide ISPs, an SNS worm on Windows, and an offline app installation and community promotion. Many victims have discussed YiSpecter infections of their jailbroken and non-jailbroken iPhones in online forums and have reported the activity to Apple. The malware has been in the wild for over 10 months, but out of 57 security vendors in VirusTotal, only one is detecting the malware at the time of this writing.

Created: 2026-02-23

Indicators

類似Pulses

このPulseに関連する脅威アクター (事実ベース)

Winnti Group

Score: 3.29
Matched TTPs:
  • T1014 - Rootkit
MITREへのリンク →

APT41

Score: 9.18
Matched TTPs:
  • T1014 - Rootkit
  • T1190 - Exploit Public-Facing Application
  • T1195.002 - Compromise Software Supply Chain
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

Rocke

Score: 10.86
Matched TTPs:
  • T1014 - Rootkit
  • T1190 - Exploit Public-Facing Application
  • T1552.004 - Private Keys
  • T1564.001 - Hidden Files and Directories
MITREへのリンク →

TeamTNT

Score: 8.70
Matched TTPs:
  • T1014 - Rootkit
  • T1608.001 - Upload Malware
  • T1552.004 - Private Keys
MITREへのリンク →

APT28

Score: 24.75
Matched TTPs:
  • T1014 - Rootkit
  • T1091 - Replication Through Removable Media
  • T1190 - Exploit Public-Facing Application
  • T1203 - Exploitation for Client Execution
  • T1498 - Network Denial of Service
  • T1564.001 - Hidden Files and Directories
  • T1550.001 - Application Access Token
  • T1211 - Exploitation for Defense Evasion
MITREへのリンク →

UNC3886

Score: 15.43
Matched TTPs:
  • T1014 - Rootkit
  • T1190 - Exploit Public-Facing Application
  • T1681 - Search Threat Vendor Data
  • T1588.001 - Malware
  • T1203 - Exploitation for Client Execution
  • T1124 - System Time Discovery
MITREへのリンク →

Mustard Tempest

Score: 6.51
Matched TTPs:
  • T1583.008 - Malvertising
  • T1608.001 - Upload Malware
MITREへのリンク →

Gamaredon Group

Score: 8.85
Matched TTPs:
  • T1091 - Replication Through Removable Media
  • T1608.001 - Upload Malware
  • T1480 - Execution Guardrails
MITREへのリンク →

LuminousMoth

Score: 10.13
Matched TTPs:
  • T1091 - Replication Through Removable Media
  • T1608.001 - Upload Malware
  • T1588.001 - Malware
  • T1564.001 - Hidden Files and Directories
MITREへのリンク →

Aoqin Dragon

Score: 4.53
Matched TTPs:
  • T1091 - Replication Through Removable Media
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

Darkhotel

Score: 7.12
Matched TTPs:
  • T1091 - Replication Through Removable Media
  • T1203 - Exploitation for Client Execution
  • T1124 - System Time Discovery
MITREへのリンク →

Mustang Panda

Score: 13.30
Matched TTPs:
  • T1091 - Replication Through Removable Media
  • T1608.001 - Upload Malware
  • T1203 - Exploitation for Client Execution
  • T1027.007 - Dynamic API Resolution
  • T1564.001 - Hidden Files and Directories
MITREへのリンク →

FIN7

Score: 17.33
Matched TTPs:
  • T1091 - Replication Through Removable Media
  • T1608.001 - Upload Malware
  • T1190 - Exploit Public-Facing Application
  • T1195.002 - Compromise Software Supply Chain
  • T1564.001 - Hidden Files and Directories
  • T1124 - System Time Discovery
  • T1078.003 - Local Accounts
MITREへのリンク →

Tropic Trooper

Score: 9.86
Matched TTPs:
  • T1091 - Replication Through Removable Media
  • T1203 - Exploitation for Client Execution
  • T1564.001 - Hidden Files and Directories
  • T1078.003 - Local Accounts
MITREへのリンク →

Sandworm Team

Score: 15.55
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1195 - Supply Chain Compromise
  • T1190 - Exploit Public-Facing Application
  • T1592.002 - Software
  • T1195.002 - Compromise Software Supply Chain
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

TA2541

Score: 4.43
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1588.001 - Malware
MITREへのリンク →

Earth Lusca

Score: 5.90
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1190 - Exploit Public-Facing Application
  • T1588.001 - Malware
MITREへのリンク →

Kimsuky

Score: 6.11
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1190 - Exploit Public-Facing Application
  • T1078.003 - Local Accounts
MITREへのリンク →

OilRig

Score: 7.31
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1195 - Supply Chain Compromise
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

LazyScripter

Score: 4.43
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1588.001 - Malware
MITREへのリンク →

Threat Group-3390

Score: 7.86
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1190 - Exploit Public-Facing Application
  • T1195.002 - Compromise Software Supply Chain
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

TA505

Score: 4.43
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1588.001 - Malware
MITREへのリンク →

BlackByte

Score: 7.29
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1190 - Exploit Public-Facing Application
  • T1480 - Execution Guardrails
MITREへのリンク →

BITTER

Score: 3.47
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

APT32

Score: 8.80
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1203 - Exploitation for Client Execution
  • T1564.001 - Hidden Files and Directories
  • T1078.003 - Local Accounts
MITREへのリンク →

Saint Bear

Score: 3.47
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

Moonstone Sleet

Score: 4.90
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1195.002 - Compromise Software Supply Chain
MITREへのリンク →

Contagious Interview

Score: 9.95
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1681 - Search Threat Vendor Data
  • T1480 - Execution Guardrails
MITREへのリンク →

EXOTIC LILY

Score: 3.47
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

Ember Bear

Score: 9.27
Matched TTPs:
  • T1195 - Supply Chain Compromise
  • T1190 - Exploit Public-Facing Application
  • T1588.001 - Malware
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

Volt Typhoon

Score: 10.43
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1552.004 - Private Keys
  • T1124 - System Time Discovery
  • T1090.001 - Internal Proxy
MITREへのリンク →

BackdoorDiplomacy

Score: 3.93
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1588.001 - Malware
MITREへのリンク →

GOLD SOUTHFIELD

Score: 4.40
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1195.002 - Compromise Software Supply Chain
MITREへのリンク →

FIN13

Score: 7.06
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1564.001 - Hidden Files and Directories
  • T1090.001 - Internal Proxy
MITREへのリンク →

Magic Hound

Score: 5.31
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1592.002 - Software
MITREへのリンク →

Medusa Group

Score: 9.63
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1529 - System Shutdown/Reboot
  • T1218.014 - MMC
MITREへのリンク →

Sea Turtle

Score: 5.63
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1203 - Exploitation for Client Execution
  • T1078.003 - Local Accounts
MITREへのリンク →

Storm-0501

Score: 4.91
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1552.004 - Private Keys
MITREへのリンク →

APT29

Score: 5.63
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1203 - Exploitation for Client Execution
  • T1078.003 - Local Accounts
MITREへのリンク →

Dragonfly

Score: 5.89
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1195.002 - Compromise Software Supply Chain
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

Play

Score: 4.14
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1078.003 - Local Accounts
MITREへのリンク →

HAFNIUM

Score: 10.93
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1564.001 - Hidden Files and Directories
  • T1550.001 - Application Access Token
  • T1078.003 - Local Accounts
MITREへのリンク →

APT39

Score: 4.40
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1090.001 - Internal Proxy
MITREへのリンク →

MoustachedBouncer

Score: 4.54
Matched TTPs:
  • T1659 - Content Injection
MITREへのリンク →

Scattered Spider

Score: 5.90
Matched TTPs:
  • T1552.004 - Private Keys
  • T1588.001 - Malware
MITREへのリンク →

Andariel

Score: 7.80
Matched TTPs:
  • T1588.001 - Malware
  • T1592.002 - Software
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

Turla

Score: 10.65
Matched TTPs:
  • T1588.001 - Malware
  • T1124 - System Time Discovery
  • T1090.001 - Internal Proxy
  • T1078.003 - Local Accounts
MITREへのリンク →

Lazarus Group

Score: 21.97
Matched TTPs:
  • T1574.013 - KernelCallbackTable
  • T1203 - Exploitation for Client Execution
  • T1027.007 - Dynamic API Resolution
  • T1564.001 - Hidden Files and Directories
  • T1124 - System Time Discovery
  • T1090.001 - Internal Proxy
  • T1529 - System Shutdown/Reboot
MITREへのリンク →

Cobalt Group

Score: 4.42
Matched TTPs:
  • T1195.002 - Compromise Software Supply Chain
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

Sidewinder

Score: 4.09
Matched TTPs:
  • T1203 - Exploitation for Client Execution
  • T1124 - System Time Discovery
MITREへのリンク →

The White Company

Score: 4.09
Matched TTPs:
  • T1203 - Exploitation for Client Execution
  • T1124 - System Time Discovery
MITREへのリンク →

Higaisa

Score: 7.01
Matched TTPs:
  • T1203 - Exploitation for Client Execution
  • T1124 - System Time Discovery
  • T1090.001 - Internal Proxy
MITREへのリンク →

APT37

Score: 5.12
Matched TTPs:
  • T1203 - Exploitation for Client Execution
  • T1529 - System Shutdown/Reboot
MITREへのリンク →

BRONZE BUTLER

Score: 4.09
Matched TTPs:
  • T1203 - Exploitation for Client Execution
  • T1124 - System Time Discovery
MITREへのリンク →

Transparent Tribe

Score: 4.16
Matched TTPs:
  • T1203 - Exploitation for Client Execution
  • T1564.001 - Hidden Files and Directories
MITREへのリンク →

Equation

Score: 4.13
Matched TTPs:
  • T1564.005 - Hidden File System
MITREへのリンク →

Strider

Score: 7.06
Matched TTPs:
  • T1564.005 - Hidden File System
  • T1090.001 - Internal Proxy
MITREへのリンク →

Velvet Ant

Score: 9.73
Matched TTPs:
  • T1090.001 - Internal Proxy
  • T1078.003 - Local Accounts
  • T1211 - Exploitation for Defense Evasion
MITREへのリンク →

APT38

Score: 3.62
Matched TTPs:
  • T1529 - System Shutdown/Reboot
MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

APT28

Score: 0.80
Matched TTPs:
  • T1564.001 - Hidden Files and Directories
  • T1550.001 - Application Access Token
  • T1091 - Replication Through Removable Media
  • T1190 - Exploit Public-Facing Application
  • T1203 - Exploitation for Client Execution
  • T1211 - Exploitation for Defense Evasion
  • T1014 - Rootkit
  • T1498 - Network Denial of Service
MITREへのリンク →

Lazarus Group

Score: 0.72
Matched TTPs:
  • T1564.001 - Hidden Files and Directories
  • T1529 - System Shutdown/Reboot
  • T1124 - System Time Discovery
  • T1203 - Exploitation for Client Execution
  • T1027.007 - Dynamic API Resolution
  • T1090.001 - Internal Proxy
  • T1574.013 - KernelCallbackTable
MITREへのリンク →

FIN7

Score: 0.64
Matched TTPs:
  • T1564.001 - Hidden Files and Directories
  • T1091 - Replication Through Removable Media
  • T1190 - Exploit Public-Facing Application
  • T1078.003 - Local Accounts
  • T1195.002 - Compromise Software Supply Chain
  • T1124 - System Time Discovery
  • T1608.001 - Upload Malware
MITREへのリンク →

UNC3886

Score: 0.58
Matched TTPs:
  • T1681 - Search Threat Vendor Data
  • T1190 - Exploit Public-Facing Application
  • T1124 - System Time Discovery
  • T1203 - Exploitation for Client Execution
  • T1014 - Rootkit
  • T1588.001 - Malware
MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

← Pulse一覧に戻る