Volexity Blog

iVerify uses a variety of methods to detect if the phone has a security issue. Some of them are deterministic and report with complete certainty. For example, the Volexity report about EVIL EYE includes IOCs for the exploit payload and we can detect and report whether that payload exists on your phone. (read that report here: https://www.volexity.com/blog/2020/04/21/evil-eye-threat-actor-resurfa… We also include more probabilistic, generic, or environmental checks that look for deviations from the known good for iOS. These are based on our deep knowledge of iOS and use little-noticed side channels to report information about iOS to the iVerify mobile app. These can possibly detect unknown jailbreaks. We walk a thin line to write our checks without violating Apple's rules (e.g., no private APIs). It's certainly not foolproof, there are ways that a malware toolkit could avoid iVerify, but it's a great extra seatbelt to wear. It's also extremely effective at determining exposure to an attack immediately after IOCs are released.

Related: https://www.volexity.com/blog/2025/02/13/multiple-russian-threat-actor…

An explanation of the attack by the company doing the investigation: https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-h…

This was extensively covered when it first broke: https://news.ycombinator.com/item?id=31602288 https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atla… (this article seems like blogspam to me)

>No one sane runs confluence as root. See "Figure 1. Process tree in Volexity Volcano Server from the infected Confluence server" https://www.volexity.com/wp-content/uploads/2022/06/Figure1.png I didn't mean running as non-root would fix the problem, just that a remote root RCE was worse than a normal RCE.

The discoverers of the vulnerability posted this write-up: https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atla… This looks like a bad one, folks. Their advice is "turn off your confluence server until a patch is available".

https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-lau… Many interesting details in this write-up from Volexity.

https://techcrunch.com/2019/08/31/china-google-iphone-uyghur/ https://www.volexity.com/blog/2019/09/02/digital-crackdown-large-scale… https://www.theguardian.com/world/2019/jul/27/the-world-knows-what-is-… https://www.forbes.com/sites/johnkoetsier/2019/09/06/apple-hints-china…

> Interestingly, no one has done a deep dive on what Android exploits were hosted on the site that Google discovered Volexity did [1], although it's not clear if the android exploits were hosted on the same sites that google was referencing. [1]: https://www.volexity.com/blog/2019/09/02/digital-crackdown-large-scale…

Maybe so, but in this case they made it easy for them [1]: > Upon examining those logs, Volexity found that in January and February, password-spray attacks had been carried out against this service and three accounts had been successfully compromised by an attacker. > ... > The Enterprise Wi-Fi network, however, did not require MFA and only required a user's valid domain username and password to authenticate > ... > While the Guest Wi-Fi network had been believed to be completely isolated from the corporate wired network, where the high-value targeted data resided, there was one system that was accessible from both the Wi-Fi network and the corporate wired network. Bad passwords, no certificate based network authentication or MFA, bad network separation. Basic stuff. [1] https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-h… (This should have been the referenced page IMHO.)

https://www.volexity.com/blog/2021/03/02/active-exploitation-of-micros… https://www.reddit.com/r/sysadmin/comments/lwcnkn/exchange_servers_und… https://www.reddit.com/r/sysadmin/comments/lwah3d/exchange_server_crit… https://magoo.github.io/incident-tracking/2021/03/02/msft-exchange-0da… https://blogs.microsoft.com/on-the-issues/2021/03/02/new-nation-state-…

Washington Post attributed the attack to Russian actor APT29/Cozy Bear on Dec 14th [1], quoting unnamed sources. FireEye [2] Dec 13th & Volexity [3] Dec 14th were more cautious, citing an unknown actor that they dubbed UNC2452, and Dark Halo, respectively. Recorded Future made a fair but ultimately inconclusive case for Chinese attribution [4], Dec 30th. US gov/CISA continues to claim "Russian linked" [5], Jan 5th. Kaspersky reported a link to the Kazuar malware used by Russian actor Turla [6], Jan 11th. CrowdStrike's report on the malware injector [7], Jan 11th says "does not attribute the SUNSPOT implant, SUNBURST backdoor or TEARDROP post-exploitation tool to any known adversary". [1] https://www.washingtonpost.com/national-security/russian-government-sp… [2] https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-… [3] https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwind… [4] https://www.recordedfuture.com/solarwinds-attribution/ [5] https://www.cisa.gov/news/2021/01/05/joint-statement-federal-bureau-in… [6] https://securelist.com/sunburst-backdoor-kazuar/99981/ [7]…