Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

iOS Trojan “TinyV” Attacks Jailbroken Devices

Summary: Unit 42 discovered in October 2015 a new iOS Trojan family it named TinyV, which was repackaged into pirated apps for jailbroken devices including Watermelon Player, Youku and iQiYi, and Chinese users reported infections in December 2015. The malware hides a Mach-O dynamic library inside files named xg.png and zippo_on@2x.png, loads it through the main executable's import table, contacts C2 servers wx[.]iosyy.me and apt[.]appstt.com for configuration, and installs a launch daemon called locka that uses MobileInstallation private APIs to install and uninstall IPA files.

Key Takeaway: TinyV began promoting a jailbreak tweak called XZ Helper on December 12, and because of its C2 command set it reinstalled the tweak immediately after victims deleted it - a persistence loop that defeats the usual remove-and-move-on response.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related