Cache Me If You Can: Modern IOS Spyware and the Vanishing Forensic Trail

Cache Me If You Can: Modern IOS Spyware and the Vanishing Forensic Trail

Speakers: Kevin Hoganson, Senior Threat Hunter, iVerify

Conference: CYBERWARCON

YouTube: https://www.youtube.com/watch?v=YYxY7r2k6Zs

Overview

In the rapidly evolving landscape of mobile security, commercial spyware poses an increasingly sophisticated and insidious threat, particularly against high-value targets leveraging Apple's iOS ecosystem. This talk, "Cache Me If You Can: Modern IOS Spyware and the Vanishing Forensic Trail," delivered by Kevin Hoganson, a Senior Threat Hunter at iVerify, dissects the advanced tactics employed by commercial spyware vendors (CSVs) to compromise iPhones and, critically, to erase their tracks, leaving minimal or no forensic evidence. Hoganson highlights a significant shift in adversary tradecraft from noisy, persistent infections to ephemeral, zero-click exploits designed to "burn off" and destroy crucial forensic artifacts.

The presentation serves as a critical examination of how CSVs, learning from public disclosures and investigative efforts, continuously refine their techniques to evade detection and analysis. Hoganson, drawing from his extensive background in offensive security and tracking sophisticated threat actors, emphasizes the "going dark" problem—where traditional digital forensics methods are becoming insufficient against adversaries who actively subvert post-mortem analysis. The talk not only illustrates the formidable challenges faced by incident responders and forensic analysts but also proposes a paradigm shift towards continuous monitoring and frequent telemetry acquisition as a vital countermeasure.

Background

▶ Watch: Introduction to modern iOS spyware and landscape (0:00)

The commercial spyware landscape is a complex, cutthroat ecosystem responsible for a significant number of sophisticated exploits observed in the wild. Historically, entities like NSO Group have been at the forefront of developing advanced iOS compromise capabilities, with their victimology and tactics, techniques, and procedures (TTPs) being extensively documented by organizations such as Citizen Lab, Amnesty International, and Google's Threat Intelligence Group. Hoganson traces NSO Group's evolution from 2016 to the present, illustrating a relentless pursuit of stealth and evasion.

In 2016, NSO Group's Pegasus spyware relied on remote jailbreaks for persistence, a method that was inherently noisy and left easily identifiable indicators of compromise (IOCs). Traditional forensics could readily expose these infections. However, following significant public disclosures and "bad press," NSO Group dramatically overhauled its approach. By 2019, they had transitioned to one-click or stealthy zero-click infection chains, opting to re-exploit targets rather than maintain persistent, detectable implants. At this stage, investigating network infrastructure or capturing VPN configurations could still expose the infection chain and even the implant itself. NSO's bridge head process also stood out in network and data usage databases, providing crucial artifacts for investigators.

By 2021, NSO Group's sophistication rivaled nation-state actors. The infamous Forced Entry exploit chain exemplified this, reducing the number of exploits needed by leveraging existing operating system mechanisms. Crucially, NSO began spoofing core services and implementing extensive artifact cleanup during post-exploitation. This included securely wiping payloads from the file system, disabling analytics, suppressing logs during agent execution, and "burning off" the device within an hour or two of implant execution. The evolution continued into 2022, with Pegasus actively wiping the shutdown log, an artifact whose significance would only gain notoriety in 2024 with the disclosure of Triangulation. As of what the speaker refers to as iOS version 26 (likely a reference to a recent major iOS version, possibly a typo for iOS 16 or 17 given the timeframe), this critical log artifact is now wiped between every power cycle, further hindering forensic analysis. This historical context underscores the constant cat-and-mouse game between spyware developers and security researchers, where every public disclosure fuels further advancements in evasion tradecraft.

Key Findings

▶ Watch: NSO's advanced artifact cleanup and OS spoofing (3:00)

The central finding of this talk is the escalating challenge posed by modern iOS spyware's deliberate and sophisticated efforts to destroy forensic artifacts, rendering traditional post-mortem analysis increasingly ineffective. This phenomenon is termed the "going dark" problem. Kevin Hoganson presents a compelling case study of NoClip, a sample believed to be developed by Turkey-based PARS Defense, a prominent vendor in iOS exploitation. NoClip exemplifies the current state-of-the-art in artifact destruction.

NoClip's infection chain, likely exploiting Apple's WebKit, specifically targets and destroys artifacts associated with the analytics daemon (analyticsd), Apple Push Notifications (APNs), and Identity Services. These data sources are often crucial for understanding exploit flows or target reconnaissance phases involving Apple services. Furthermore, NoClip is designed to eliminate logs maintained by CrashReporter, which are vital for identifying failed exploitation attempts against remote attack surfaces or containerized client applications. Once a one-click infection is successful, NoClip meticulously cleans up after itself.

A particularly striking discovery highlighted by Hoganson is the explicit inclusion of a function named pone_citizen_lab within the NoClip agent's execution flow. This function is deliberately invoked between every agent module, serving to trample or delete the very forensic data sources that organizations like Citizen Lab have historically relied upon for their investigative efforts. The naming convention itself underscores the adversaries' acute awareness of their opponents' methodologies and their proactive measures to neutralize them. The talk also reveals NoClip's advanced technique of hijacking legitimate iOS processes and services. It operates like a debugger, bridging a local process and a remote child process, making malicious alterations before kicking off the child process. This allows the agent to leverage legitimate iOS processes for self-cleanup, significantly complicating analysis and attribution. These findings collectively paint a grim picture for traditional digital forensics, emphasizing the urgent need for new defensive paradigms.

Technical Deep Dive

▶ Watch: NoClip spyware destroying specific forensic artifacts (5:20)

The technical sophistication of modern iOS spyware, as detailed by Hoganson, represents a significant leap from earlier generations. The evolution of NSO Group's Pegasus serves as a prime example:

• Early Persistence (2016): Initially, Pegasus relied on remote jailbreaks. These were noisy, leaving clear indicators of compromise (IOCs) that traditional forensic tools could easily detect. Network traffic analysis and even VPN configurations could expose the entire infection chain.
• Re-Exploitation and Stealth (2019): NSO pivoted to one-click or zero-click infection chains, prioritizing re-exploitation over persistent, detectable implants. Artifacts like NSO's "bridge head process" were still identifiable in net usage and data usage databases.
• Operating System Integration and Cleanup (2021): With exploits like Forced Entry, NSO began integrating with existing operating system mechanisms, reducing the number of exploits required. A key technique was spoofing core services to blend in. Post-exploitation, the agent implemented extensive cleanup:
• Secure payload wiping: Deleting the implant payload from the file system.
• Analytics disabling: Suppressing device analytics.
• Log suppression: Preventing logs during agent execution.
• Ephemeral execution: Self-destructing or "burning off" within an hour or two.
• Advanced Artifact Erasure (2022-2023): Pegasus began wiping critical system logs, most notably the shutdown log, an artifact that provides crucial insights into device power cycles and potential reboots following exploitation. As per the talk, as of iOS version 26 (a likely reference to a recent iOS major version), this log is now routinely wiped between power cycles, severely impacting forensic timelines. Modern agents also deliberately destroy crash artifacts that could indicate how exploitation occurred, leverage technique reuse and multi-stage deployment for complexity, and transmit keys via iMessage, making acquisition highly improbable.

The NoClip sample developed by PARS Defense further illustrates this advanced tradecraft:

• WebKit Exploitation: NoClip likely initiates its infection chain through Apple's WebKit, a common attack surface for iOS exploits.
• Targeted Artifact Destruction: Upon successful execution, NoClip meticulously destroys specific forensic data sources:
• analyticsd artifacts: Data related to device usage and diagnostics.
• Apple Push Notification (APN) artifacts: Traces of push notifications, which can be part of exploit delivery or reconnaissance.
• Identity Services artifacts: Data related to user accounts and authentication, potentially revealing reconnaissance activities.
• CrashReporter logs: These logs are invaluable for identifying failed exploitation attempts or unexpected system behavior, and their destruction blinds forensic analysts to crucial events.
• The pone_citizen_lab Function: This explicitly named function is a direct response to the forensic methodologies of groups like Citizen Lab. It is called between every agent module execution, ensuring that any forensic data generated by a module is immediately destroyed or trampled before the next module proceeds. This systematic destruction specifically targets data sources known to be valuable in past investigations.
• Process Hijacking: NoClip employs a sophisticated technique akin to a debugger. It hijacks legitimate iOS processes and services, using different process contexts to execute malicious tasks. The agent acts as a "bridge" between a local process and a remote child process that has not yet been spawned. Malicious alterations are made to the child process, which is then launched. This allows the parent agent to leverage the legitimate child process's context and privileges to perform cleanup operations, making it extremely difficult to differentiate malicious activity from legitimate system processes during analysis. The result is a highly obfuscated and resilient cleanup mechanism that severely hinders forensic efforts.

Demo / Proof of Concept

▶ Watch: The 'Going Dark' problem and forensic challenges (8:00)

While Kevin Hoganson's presentation did not feature a live code demonstration or an interactive proof of concept, he effectively conveyed the "going dark" problem and the proposed solution through illustrative timelines and conceptual visualizations. The "demo" essentially highlighted the diminishing forensic trail left by modern spyware.

Hoganson presented a visual timeline representing various forensic artifacts and telemetry. Initially, this timeline showed no indicators of compromise. He then presented an "altered timeline with a legitimate Pegasus infection," illustrating where IOCs would typically appear. Crucially, he then showed "the same Pegasus infection post cleanup," which starkly demonstrated the absence of many critical IOCs. This visual emphasized how adversaries actively erase the very traces that forensic investigators rely upon.

However, Hoganson noted that even after cleanup, certain IOCs might still be present, albeit in less obvious locations, such as within an encrypted backup instance or other overlooked artifacts. This led to the conceptual demonstration of "continuous monitoring." By showing a timeline with "more telemetry acquired over time" and "additional IOC coverage between sysdiagnose archive and the collection of device telemetry," he illustrated how frequent data acquisition could reveal historical or current infections that would otherwise be missed by a one-time, post-compromise forensic dump. This conceptual "demo" effectively underscored the problem's severity and the potential of his proposed solution.

Defensive Implications

▶ Watch: Continuous monitoring and new telemetry for detection (9:50)

The detailed analysis of modern iOS spyware's artifact destruction techniques carries profound implications for cybersecurity defenders. Kevin Hoganson makes it clear that the current reliance on traditional digital forensics, characterized by one-time data acquisitions using tools like Mobile Verification Toolkit (MVT) and full file system dumps, is rapidly becoming insufficient. The "going dark" problem means that by the time a victim provides their device for analysis, or even becomes aware of a compromise, critical evidence may have already been destroyed.

To counteract this, defenders must adopt a proactive and continuous approach:

1. Continuous Monitoring and Frequent Telemetry Acquisition: This is paramount. Instead of reactive, post-mortem analysis, organizations should implement mechanisms for the consistent and frequent collection of device telemetry. This includes sysdiagnose archives and other device behavioral data. The goal is to capture transient artifacts and state changes before they are wiped, building a historical record that can reveal even ephemeral infections.
2. Explore New Telemetry Sources: Security researchers and defenders must actively identify and explore novel sources of telemetry beyond what is traditionally collected. As adversaries learn to clean existing artifacts, new and overlooked data points may become critical for detection.
3. Heuristics and Behavioral Detections: Given the vanishing nature of static IOCs, the focus must shift towards heuristics and behavioral detections. This involves identifying anomalous patterns of activity, unusual process interactions (like the process hijacking seen in NoClip), or deviations from baseline device behavior that might indicate exploitation or agent execution, even without specific, identifiable file-based IOCs.
4. IOCs Remain Relevant (but Evolving): While direct IOCs are harder to find, they are not entirely obsolete. Defenders should leverage existing threat intelligence feeds and synthesize data to identify evolving IOCs, particularly those that might persist in less obvious locations or are generated by imperfect cleanup processes.
5. Integrated Threat Intelligence: Continuous monitoring is most effective when combined with a holistic approach to threat intelligence, including network threat intelligence (to identify C2 communications or staging infrastructure), identity intelligence (to track potential targets and adversary profiles), and traditional digital forensics (for deeper analysis when artifacts are found).

Ultimately, the defensive posture against modern iOS spyware requires a shift from a "snapshot" forensic approach to a "streaming" or "continuous" one, where the goal is to observe and record device behavior over time, anticipating and mitigating the adversary's efforts to erase their tracks.

Key Takeaways

• Spyware Evolves Rapidly: Commercial spyware vendors (CSVs) like NSO Group and PARS Defense continuously enhance their tradecraft in response to public disclosures and forensic analysis, moving from noisy persistence to stealthy, ephemeral, zero-click exploits.
• The "Going Dark" Problem is Real: Modern iOS spyware deliberately destroys crucial forensic artifacts (e.g., analyticsd, APNs, Identity Services, CrashReporter logs, shutdown logs), making traditional post-mortem digital forensics increasingly challenging and often futile.
• Targeted Artifact Destruction: Spyware samples like NoClip explicitly include functions (e.g., pone_citizen_lab) designed to trample or delete forensic data sources known to be valuable to investigative organizations.
• Sophisticated Evasion Techniques: Adversaries are employing advanced techniques such as spoofing core services, leveraging multi-stage deployments, and hijacking legitimate iOS processes to conduct malicious tasks and facilitate self-cleanup, making detection and attribution significantly harder.
• Continuous Monitoring is Crucial: To combat the vanishing forensic trail, defenders must shift from reactive, one-time data acquisitions to proactive, continuous monitoring and frequent collection of device telemetry (e.g., sysdiagnose archives) to capture transient indicators.
• Shift to Behavioral Detections: Reliance on static IOCs is diminishing. Future defensive strategies must prioritize heuristics and behavioral detections to identify anomalous activity patterns and deviations from normal device operation, even when direct artifact evidence is absent.

About the Speaker(s)

Kevin Hoganson is a Senior Threat Hunter at iVerify, where his work focuses exclusively on the evolving threats posed by commercial spyware and mobile surveillance capabilities. Hoganson brings a robust background in offensive security, having previously worked for the government. His experience includes extensive work in the Cyber Threat Intelligence (CTI) domain, where he tracked numerous sophisticated actors, particularly Russian groups and "bearer activity." His current role at iVerify leverages this deep understanding of adversary TTPs to counter the highly advanced and evasive nature of modern commercial spyware targeting mobile devices.