Export from MISP Threat Report The Million Dollar Dissident: NSO Group’s iPhone Zero-Days used against a UAE Human Rights Defender (MISP Event #10) Threat Report External analysis: CVE-2016-4656 (MISP Attribute #463) An application may be able to execute arbitrary code with kernel privileges An application may be able to execute arbitrary code with kernel privileges CVE-2016-4656 External analysis: CVE-2016-4655 (MISP Attribute #464) An application may be able to disclose kernel memory An application may be able to disclose kernel memory CVE-2016-4655 External analysis: CVE-2016-4657 (MISP Attribute #465) Visiting a maliciously crafted website may lead to arbitrary code execution Visiting a maliciously crafted website may lead to arbitrary code execution CVE-2016-4657 Payload type: Pegasus (MISP Attribute #1313) NSO Group product Pegasus The Million Dollar Dissident: NSO Group’s iPhone Zero-Days used against a UAE Human Rights Defender 10 2016-08-24T00:00:00+00:00 2016-11-08T15:31:51+00:00 Closed Attribution Attribution: NSO Group (MISP Attribute #498) Malware Artifacts Attribution: NSO Group (MISP Attribute #498) None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: alljazeera.co (MISP Attribute #1314) Malware Artifacts Domain Watchlist Network activity: alljazeera.co (MISP Attribute #1314) alljazeera.co High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: bbc-africa.com (MISP Attribute #1315) Malware Artifacts Domain Watchlist Network activity: bbc-africa.com (MISP Attribute #1315) bbc-africa.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: cnn-africa.co (MISP Attribute #1316) Malware Artifacts Domain Watchlist Network activity: cnn-africa.co (MISP Attribute #1316) cnn-africa.co High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: unonoticias.net (MISP Attribute #1317) Malware Artifacts Domain Watchlist Network activity: unonoticias.net (MISP Attribute #1317) unonoticias.net High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: univision.click (MISP Attribute #1318) Malware Artifacts Domain Watchlist Network activity: univision.click (MISP Attribute #1318) univision.click High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: track-your-fedex-package.org (MISP Attribute #1319) Malware Artifacts Domain Watchlist Network activity: track-your-fedex-package.org (MISP Attribute #1319) track-your-fedex-package.org High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: mz-vodacom.info (MISP Attribute #1320) Malware Artifacts Domain Watchlist Network activity: mz-vodacom.info (MISP Attribute #1320) mz-vodacom.info High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: iusacell-movil.com.mx (MISP Attribute #1321) Malware Artifacts Domain Watchlist Network activity: iusacell-movil.com.mx (MISP Attribute #1321) iusacell-movil.com.mx High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: sabafon.info (MISP Attribute #1322) Malware Artifacts Domain Watchlist Network activity: sabafon.info (MISP Attribute #1322) sabafon.info High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: newtarrifs.net (MISP Attribute #1323) Malware Artifacts Domain Watchlist Network activity: newtarrifs.net (MISP Attribute #1323) newtarrifs.net High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: y0utube.com.mx (MISP Attribute #1324) Malware Artifacts Domain Watchlist Network activity: y0utube.com.mx (MISP Attribute #1324) y0utube.com.mx High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: fb-accounts.com (MISP Attribute #1325) Malware Artifacts Domain Watchlist Network activity: fb-accounts.com (MISP Attribute #1325) fb-accounts.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: googleplay-store.com (MISP Attribute #1326) Malware Artifacts Domain Watchlist Network activity: googleplay-store.com (MISP Attribute #1326) googleplay-store.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: whatsapp-app.com (MISP Attribute #1327) Malware Artifacts Domain Watchlist Network activity: whatsapp-app.com (MISP Attribute #1327) whatsapp-app.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: accounts.mx (MISP Attribute #1328) Malware Artifacts Domain Watchlist Network activity: accounts.mx (MISP Attribute #1328) accounts.mx High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: adjust-local-settings.com (MISP Attribute #1329) Malware Artifacts Domain Watchlist Network activity: adjust-local-settings.com (MISP Attribute #1329) adjust-local-settings.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: emiratesfoundation.net (MISP Attribute #1330) Malware Artifacts Domain Watchlist Network activity: emiratesfoundation.net (MISP Attribute #1330) emiratesfoundation.net High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: checkinonlinehere.com (MISP Attribute #1331) Malware Artifacts Domain Watchlist Network activity: checkinonlinehere.com (MISP Attribute #1331) checkinonlinehere.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: turkishairines.info (MISP Attribute #1332) Malware Artifacts Domain Watchlist Network activity: turkishairines.info (MISP Attribute #1332) turkishairines.info High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: bulbazaur.com (MISP Attribute #1333) Malware Artifacts Domain Watchlist Network activity: bulbazaur.com (MISP Attribute #1333) bulbazaur.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: pickuchu.com (MISP Attribute #1334) Malware Artifacts Domain Watchlist Network activity: pickuchu.com (MISP Attribute #1334) pickuchu.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: damanhealth.online (MISP Attribute #1335) Malware Artifacts Domain Watchlist Network activity: damanhealth.online (MISP Attribute #1335) damanhealth.online High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: uaenews.online (MISP Attribute #1336) Malware Artifacts Domain Watchlist Network activity: uaenews.online (MISP Attribute #1336) uaenews.online High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: ideas-telcel.com.mx (MISP Attribute #1340) Malware Artifacts Domain Watchlist Network activity: ideas-telcel.com.mx (MISP Attribute #1340) ideas-telcel.com.mx High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: nation-news.com (MISP Attribute #1342) Malware Artifacts Domain Watchlist Network activity: nation-news.com (MISP Attribute #1342) nation-news.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: webadv.co (MISP Attribute #466) Malware Artifacts Domain Watchlist Network activity: webadv.co (MISP Attribute #466) webadv.co High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: icloudcacher.com (MISP Attribute #469) Malware Artifacts Domain Watchlist Network activity: icloudcacher.com (MISP Attribute #469) icloudcacher.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: asrarrarabiya.com (MISP Attribute #470) Malware Artifacts Domain Watchlist Network activity: asrarrarabiya.com (MISP Attribute #470) asrarrarabiya.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: asrararabiya.co (MISP Attribute #471) Malware Artifacts Domain Watchlist Network activity: asrararabiya.co (MISP Attribute #471) asrararabiya.co High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: asrararablya.com (MISP Attribute #472) Malware Artifacts Domain Watchlist Network activity: asrararablya.com (MISP Attribute #472) asrararablya.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: smser.net (MISP Attribute #473) Malware Artifacts Domain Watchlist Network activity: smser.net (MISP Attribute #473) smser.net High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: icrcworld.com (MISP Attribute #474) Malware Artifacts Domain Watchlist Network activity: icrcworld.com (MISP Attribute #474) icrcworld.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: redcrossworld.com (MISP Attribute #475) Malware Artifacts Domain Watchlist Network activity: redcrossworld.com (MISP Attribute #475) redcrossworld.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: topcontactco.com (MISP Attribute #476) Malware Artifacts Domain Watchlist Network activity: topcontactco.com (MISP Attribute #476) topcontactco.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: thainews.asia (MISP Attribute #477) Malware Artifacts Domain Watchlist Network activity: thainews.asia (MISP Attribute #477) thainews.asia High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: kenyasms.org (MISP Attribute #478) Malware Artifacts Domain Watchlist Network activity: kenyasms.org (MISP Attribute #478) kenyasms.org High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: qaintqa.com (MISP Attribute #479) Malware Artifacts Domain Watchlist Network activity: qaintqa.com (MISP Attribute #479) qaintqa.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: nsoqa.com (MISP Attribute #480) Malware Artifacts Domain Watchlist Network activity: nsoqa.com (MISP Attribute #480) nsoqa.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: ooredoodeals.com (MISP Attribute #481) Malware Artifacts Domain Watchlist Network activity: ooredoodeals.com (MISP Attribute #481) ooredoodeals.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: alawaeltech.com (MISP Attribute #482) Malware Artifacts Domain Watchlist Network activity: alawaeltech.com (MISP Attribute #482) alawaeltech.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: bahrainsms.co (MISP Attribute #483) Malware Artifacts Domain Watchlist Network activity: bahrainsms.co (MISP Attribute #483) bahrainsms.co High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: turkeynewsupdates.com (MISP Attribute #484) Malware Artifacts Domain Watchlist Network activity: turkeynewsupdates.com (MISP Attribute #484) turkeynewsupdates.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: mail1.nsogroup.com (MISP Attribute #486) Malware Artifacts Domain Watchlist Network activity: mail1.nsogroup.com (MISP Attribute #486) mail1.nsogroup.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: 52.8.153.44 (MISP Attribute #487) Malware Artifacts IP Watchlist Network activity: 52.8.153.44 (MISP Attribute #487) 52.8.153.44 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: 52.8.52.166 (MISP Attribute #488) Malware Artifacts IP Watchlist Network activity: 52.8.52.166 (MISP Attribute #488) 52.8.52.166 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: 162.209.103.68 (MISP Attribute #489) Malware Artifacts IP Watchlist Network activity: 162.209.103.68 (MISP Attribute #489) 162.209.103.68 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: 82.80.202.200 (MISP Attribute #490) Malware Artifacts IP Watchlist Network activity: 82.80.202.200 (MISP Attribute #490) 82.80.202.200 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: 82.80.202.204 (MISP Attribute #491) Malware Artifacts IP Watchlist Network activity: 82.80.202.204 (MISP Attribute #491) 82.80.202.204 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: 54.251.49.214 (MISP Attribute #492) Malware Artifacts IP Watchlist Network activity: 54.251.49.214 (MISP Attribute #492) 54.251.49.214 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: https://smser.net/9918216t/ (MISP Attribute #493) Malware Artifacts URL Watchlist Network activity: https://smser.net/9918216t/ (MISP Attribute #493) https://smser.net/9918216t/ High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: https://smser.net/redirect.aspx (MISP Attribute #494) Malware Artifacts URL Watchlist Network activity: https://smser.net/redirect.aspx (MISP Attribute #494) https://smser.net/redirect.aspx High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: aalaan.tv (MISP Attribute #467) Malware Artifacts Domain Watchlist Payload delivery: aalaan.tv (MISP Attribute #467) aalaan.tv High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: manoraonline.net (MISP Attribute #468) Malware Artifacts Domain Watchlist Payload delivery: manoraonline.net (MISP Attribute #468) manoraonline.net High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: sms.webadv.co (MISP Attribute #485) Malware Artifacts Domain Watchlist Payload delivery: sms.webadv.co (MISP Attribute #485) sms.webadv.co High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: pn1g3p@sigaint.org (MISP Attribute #497) Malware Artifacts Malicious E-mail Payload delivery: pn1g3p@sigaint.org (MISP Attribute #497) pn1g3p@sigaint.org None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: https://sms.webadv.co/3589003s/ (MISP Attribute #1311) Malware Artifacts URL Watchlist Payload delivery: https://sms.webadv.co/3589003s/ (MISP Attribute #1311) https://sms.webadv.co/3589003s/ High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: https://sms.webadv.co/9573305s/ (MISP Attribute #1312) Malware Artifacts URL Watchlist Payload delivery: https://sms.webadv.co/9573305s/ (MISP Attribute #1312) https://sms.webadv.co/9573305s/ High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: http://fb-accounts.com/2408931s/ (MISP Attribute #1337) Malware Artifacts URL Watchlist Payload delivery: http://fb-accounts.com/2408931s/ (MISP Attribute #1337) http://fb-accounts.com/2408931s/ High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: http://unonoticias.net/1867745s/ (MISP Attribute #1338) Malware Artifacts URL Watchlist Payload delivery: http://unonoticias.net/1867745s/ (MISP Attribute #1338) http://unonoticias.net/1867745s/ High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: https://ideas-telcel.com.mx/3975827s/ (MISP Attribute #1339) Malware Artifacts URL Watchlist Payload delivery: https://ideas-telcel.com.mx/3975827s/ (MISP Attribute #1339) https://ideas-telcel.com.mx/3975827s/ High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: nation-news.com/4077017s/ (MISP Attribute #1341) Malware Artifacts URL Watchlist Payload delivery: nation-news.com/4077017s/ (MISP Attribute #1341) nation-news.com/4077017s/ High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: http://fb-accounts.com/1074139s/ (MISP Attribute #495) Malware Artifacts URL Watchlist Payload delivery: http://fb-accounts.com/1074139s/ (MISP Attribute #495) http://fb-accounts.com/1074139s/ High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: http://unonoticias.net/3423768s/ (MISP Attribute #496) Malware Artifacts URL Watchlist Payload delivery: http://unonoticias.net/3423768s/ (MISP Attribute #496) http://unonoticias.net/3423768s/ High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none External analysis External analysis External analysis Payload type Event Threat Level: High MISP Tag: TLP:GREEN MISP Tag: SOURCE:CITIZENLAB MISP Tag: DETECT MISP Tag: PUBLISHED citizenlab https://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/ ../../../descendant-or-self::node()