Evil Eye Threat Actor Resurfaces with iOS Exploit and Updated Implant
Summary: Volexity reports that the Evil Eye threat actor resumed attacks on Uyghur websites in January 2020, using an open-source framework called IRONSQUIRREL to deliver a WebKit exploit against iOS versions 12.3, 12.3.1, and 12.3.2, which installs an implant Volexity calls INSOMNIA. Volexity observed six exploit websites, five implant instances, three C2 IP-and-port pairs, and two unique C2 IP addresses between January and March 2020, with later attacks seen only on the Uyghur Academy website.
What you should know: The implant runs as root with broad entitlements and was updated to add HTTPS with an embedded self-signed certificate, defeating the HTTP-only criticism Project Zero made of the earlier version. The actor also added Signal and ProtonMail to the list of apps it automatically steals data from, indicating the targets adopted those tools to avoid monitoring.
Read the original at Volexity Blog ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026