From 11f62012a0da02e30461fc4abfdacd1f4d413d48 Mon Sep 17 00:00:00 2001 From: Joseph Goydish II Date: Tue, 23 Sep 2025 11:14:22 -0400 Subject: [PATCH] Update README.md --- README.md | 21 +++++++-------------- 1 file changed, 7 insertions(+), 14 deletions(-) diff --git a/README.md b/README.md index b094587..8988b98 100644 --- a/README.md +++ b/README.md @@ -33,20 +33,6 @@ This repository documents a high-complexity intrusion lifecycle targeting iOS 18 Tactics indicate a well-funded adversary with low-level iOS expertise. Likely candidates include zero-day red teams, commercial spyware operators, or state-level mobile APTs. -## MITRE ATT&CK Mapping - -| Phase | Techniques Used | -|--------------------|------------------| -| Initial Access | T1557.001, T1078 | -| Execution | T1055.012, T1210 | -| Persistence | T1098, T1213.003 | -| Defense Evasion | T1027, T1070.004 | -| Credential Access | T1081, T1555.004 | -| Command & Control | T1071.001, T1090.002, T1568 | -| Collection | T1113, T1114.002 | -| Exfiltration | T1020, T1002 | -| Impact | T1489, T1490 | - ## Timeline and Telemetry | Time (UTC) | Event | Interface | UUID/Notes | @@ -56,3 +42,10 @@ Tactics indicate a well-funded adversary with low-level iOS expertise. Likely ca | 08/16 17:24 | Trust Record Removal | lockdownd | 61C4967E...| | 08/16 17:24 | CloudKit Sync Reset | bird | - | +--- + +## Why This Matters + +The device logged a short VPN session on bridge0 (UUID C4F19DD3…), an awdl0 stop event, a trust-record removal in lockdownd (UUID 61C4967E…), and a CloudKit sync reset by bird — all within seconds. This clustered activity is unusual and may indicate attempts to create a temporary tunnel, mask wireless activity, clear pairing records, and sanitize cloud traces. + +For a normal user nothing would look wrong — no pop-ups, no warnings, nothing odd on the screen — but in the background photos, messages, or account data could be copied out while the phone makes itself look normal and clean.