{"id":46743,"date":"2024-01-17T14:32:14","date_gmt":"2024-01-17T11:32:14","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=46743"},"modified":"2026-03-28T04:57:40","modified_gmt":"2026-03-28T01:57:40","slug":"kaspersky-reveals-new-method-to-detect-pegasus-ios-spyware","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/kaspersky-reveals-new-method-to-detect-pegasus-ios-spyware\/","title":{"rendered":"Kaspersky reveals new method to detect Pegasus iOS spyware"},"content":{"rendered":"\n

Kaspersky researchers have revealed a new lightweight method to detect sophisticated iOS spyware <\/strong>such as Pegasus, new Pegasus-like threats Reign and Predator and created a self-check tool for users.<\/strong><\/p>\n\n\n\n

17 January 2024<\/p>\n\n\n\n

Kaspersky’s Global Research and Analysis Team (GReAT) has developed a lightweight method to detect indicators of infection from sophisticated iOS spyware such as\u00a0Pegasus<\/a>,\u00a0Reign<\/a>, and\u00a0Predator<\/a>\u00a0through analyzing Shutdown.log, a previously unexplored forensic artifact.<\/p>\n\n\n\n

The company\u2019s experts discovered Pegasus infections leave traces in the unexpected system log, Shutdown.log, stored within any mobile iOS device\u2019s sysdiagnose archive. This archive retains information from each reboot session, meaning anomalies associated with the Pegasus malware become apparent in the log if an infected user reboots their device.<\/p>\n\n\n\n

Among those identified were instances of \u201dsticky\u201c processes impeding reboots, particularly those linked to Pegasus, along with infection traces discovered through cybersecurity community\u00a0observations<\/a>.<\/p>\n\n\n\n

\u201cThe sysdiag dump analysis proves to be minimally intrusive and resource-light, relying on system-based artifacts to identify potential iPhone infections. <\/em>Having received the infection indicator in this log and confirmed the infection using Mobile Verification Toolkit (MVT\u2019s) processing of other iOS artifacts, this log now becomes part of a holistic approach to investigating iOS malware infection. Since we confirmed the consistency of this behavior with the other Pegasus infections we analyzed, we believe it will serve as a reliable forensic artifact to support infection analysis,\u201d <\/em>comments Maher Yamout, Lead Security Researcher at Kaspersky\u2019s GReAT.<\/p>\n\n\n\n

Analyzing the Shutdown.log in Pegasus infections, Kaspersky experts observed a common infection path, specifically \u201c\/private\/var\/db\/\u201d, mirroring paths\u00a0seen<\/a>\u00a0in infections caused by other iOS malware like Reign and Predator. The company\u2019s researchers suggest this log file holds potential for identifying infections related to these malware families.<\/p>\n\n\n\n

To ease the search for spyware infections, Kaspersky\u00a0experts developed a self-check\u00a0utility<\/a>\u00a0for users.\u00a0The Python3 scripts<\/a>\u00a0facilitate the extraction, analysis, and parsing of the Shutdown.log artifact.\u00a0The tool is publicly shared on\u00a0GitHub<\/a>\u00a0and available for macOS, Windows, and Linux.<\/p>\n\n\n\n

iOS spyware, such as Pegasus, is highly sophisticated. While the cyber community may not always prevent successful exploitation, users can take steps to make it challenging for attackers. To safeguard against advanced spyware on iOS, Kaspersky experts recommend the following:<\/p>\n\n\n\n