Apple Users Hit with Rare Cyberattack: What Can We Learn?

On Wednesday, April 10, 2024, Apple deemed it necessary to send a rare alert to certain users via email, spread out across 92 nations. As Apple’s website states, these threat notifications “are designed to inform and assist users who may have been individually targeted by mercenary spyware attacks.” Let’s review these attacks so we all understand this threat better.

What are Mercenary Attacks?

When we think of more “typical” cyberattacks, they are commonly designed to target as many people as possible, often using rudimentary attack methods to identify the easiest targets to pursue. A mercenary attack is similar to this but on a much smaller scale, with millions of dollars spent to target a relatively small target pool.

As the threat notification email informed potential targets, “This attack is likely targeting you specifically because of who you are or what you do.”

The email also describes the kinds of things that this attack, as a mercenary spyware attack specifically, would likely do, stating, 

"If your device is compromised by a targeted mercenary spyware attack, the attacker may be able to remotely access your sensitive data, communications, or even the camera and microphone."

What Has Apple Done to Address the Threat?

Apple has added a support page describing these attacks, and what an impacted Apple user should do if they suspect their device is infected. This includes a list of best practices that we can very much sign off on:

• “Update devices to the latest software, as that includes the latest security fixes
• Protect devices with a passcode
• Use two-factor authentication and a strong password for Apple ID [we just want to add you should do this with all accounts]
• Install apps from the App Store [all Android users should only utilize the Google Play store]
• Use strong and unique passwords online
• Don’t click on links or attachments from unknown senders”

Apple also recommended that those who had not yet been targeted, but had reason to suspect they might be, to turn on “Lockdown Mode,” which restricts the device to very limited functions to reduce the attack surface that these kinds of targeted threats would use.

Hopefully, you won't be targeted by these kinds of attacks, but we wanted to help spread the word as much as possible, and we’re not going to miss the opportunity to share some security best practices. For more security best practices and general technology assistance for your business needs, please consider the managed services that we offer here at CoreTech. Call us at (270) 282-4926 to discuss your options with our team of experts.