QuaDream's Spyware exploits iPhones with Zero-Click ENDOFDAYS attack
Microsoft and Citizen Lab reported that an Israeli-based company, QuaDream, had used a zero-click exploit named ENDOFDAYS to compromise the iPhones of high-risk individuals.
The attackers targeted a zero-day vulnerability affecting iPhones running iOS 1.4 up to 14.4.2 between January 2021 and November 2021.
We identified two 2021 cases where targets in North America and Central Asia showed evidence that a process named /private/var/db/com.apple.xpc.roleaccountd.staging/subridged had run on the phone on iOS versions 14.4 and 14.4.2, while these were the latest iOS versions.
In one case, we were able to examine the user’s Calendar.sqlitedb file, and also connect (via CalDAV) to their iCloud calendar. The user’s Calendar.sqlitedb file showed a suspicious event added to the calendar in 2021 organised by a user [REDACTED1]@icloud.com. The summary of the event was “Meeting”, and the description of the event was “Notes”.
The spyware deployed in this campaign, dubbed KingsPawn, was designed to self-delete itself and clean out any tracks from victims’ iPhones to evade detection.
The spyware has a wide range of capabilities, including recording audio from phone calls and microphone, taking pictures through the device’s front or back camera, and tracking the device’s location.
QuaDream servers were found in multiple countries, including Bulgaria, Czech Republic, Hungary, Ghana, Israel, Mexico, Romania, Singapore, United Arab Emirates (UAE), and Uzbekistan.
Indicators of Compromise
| Domain | First active | Last active |
| fosterunch[.]com | 2022-05-30 | CURRENT |
| womnbling[.]com | 2022-05-30 | CURRENT |
| zebra-arts[.]com | 2022-05-31 | CURRENT |
| pennywines[.]com | 2022-08-19 | CURRENT |
| choccoline[.]com | 2022-08-19 | CURRENT |
| lateparties[.]com | 2022-09-15 | CURRENT |
| foundurycolletive[.]com | 2022-11-07 | CURRENT |
| jungelfruitime[.]com | 2022-11-09 | CURRENT |
| gameboysess[.]com | 2022-11-09 | CURRENT |
| healthcovid19[.]com | 2022-11-10 | CURRENT |
| codingstudies[.]com | 2022-11-16 | CURRENT |
| hoteluxurysm[.]com | 2022-11-18 | CURRENT |
| newz-globe[.]com | 2022-11-23 | CURRENT |
| hotalsextra[.]com | 2022-11-23 | CURRENT |
| nordmanetime[.]com | 2022-11-23 | CURRENT |
| fullaniimal[.]com | 2022-11-23 | CURRENT |
| wikipedoptions[.]com | 2022-11-23 | CURRENT |
| redanddred[.]com | 2022-11-23 | CURRENT |
| whiteandpiink[.]com | 2022-12-02 | CURRENT |
| agronomsdoc[.]com | 2022-12-02 | CURRENT |
| nutureheus[.]com | 2022-12-02 | CURRENT |
| timeeforsports[.]com | 2022-12-15 | CURRENT |
| treerroots[.]com | 2022-12-15 | CURRENT |
| unitedyears[.]com | 2022-12-15 | CURRENT |
| eccocredit[.]com | 2022-12-16 | CURRENT |
| ecologitics[.]com | 2022-12-19 | CURRENT |
| climatestews[.]com | 2022-12-19 | CURRENT |
| aqualizas[.]com | 2022-12-19 | CURRENT |
| bgnews-bg[.]com | 2022-12-20 | CURRENT |
| mikontravels[.]com | 2022-12-23 | CURRENT |
| e-gaming[.]online | 2022-12-23 | CURRENT |
| transformaition[.]com | 2022-12-23 | CURRENT |
| betterstime[.]com | 2022-12-23 | CURRENT |
| goshopeerz[.]com | 2022-12-23 | CURRENT |
| countshops[.]com | 2022-12-23 | CURRENT |
| inneture[.]com | 2022-12-23 | CURRENT |
| shoppingeos[.]com | 2022-12-23 | CURRENT |
| mwww[.]ro | 2023-01-05 | CURRENT |
| rentalproct[.]com | 2023-01-05 | CURRENT |
| bcarental[.]com | 2023-01-05 | CURRENT |
| kikocruize[.]com | 2023-01-05 | CURRENT |
| elvacream[.]com | 2023-01-10 | CURRENT |
| pachadesert[.]com | 2023-01-12 | CURRENT |
| razzodev[.]com | 2023-02-06 | CURRENT |
| wombatcash[.]com | 2023-02-06 | CURRENT |
| globepayinfo[.]com | 2023-02-06 | CURRENT |
| job4uhunt[.]com | 2023-02-08 | CURRENT |
| ctbgameson[.]com | 2023-02-08 | CURRENT |
| adeptary[.]com | 2023-02-08 | CURRENT |
| hinterfy[.]com | 2023-02-08 | CURRENT |
| biznomex[.]com | 2023-02-08 | CURRENT |
| careerhub4u[.]com | 2023-02-08 | CURRENT |
| furiamoc[.]com | 2023-02-08 | CURRENT |
| motorgamings[.]com | 2023-02-08 | CURRENT |
| aniarchit[.]com | 2023-02-08 | CURRENT |
| skyphotogreen[.]com | 2023-02-26 | CURRENT |
| datacentertime[.]com | 2023-02-26 | CURRENT |
| stylelifees[.]com | 2023-02-26 | CURRENT |
| kidzlande[.]com | 2023-03-01 | CURRENT |
| homelosite[.]com | 2023-03-01 | CURRENT |
| zooloow[.]com | 2023-03-01 | CURRENT |
| studiesutshifts[.]com | 2023-03-01 | CURRENT |
| codingstudies[.]com | 2023-03-08 | CURRENT |
| londonistory[.]com | 2023-03-16 | CURRENT |
| bestteamlife[.]com | 2023-03-16 | CURRENT |
| newsandlocalupdates[.]com | 2023-03-16 | CURRENT |
| youristores[.]com | 2023-03-16 | CURRENT |
| zooloow[.]com | 2023-02-26 | 2023-03-04 |
| kidzlande[.]com | 2023-02-26 | 2023-03-04 |
| homelosite[.]com | 2023-02-26 | 2023-03-04 |
| studiesutshifts[.]com | 2023-02-26 | 2023-03-04 |
| datacentertime[.]com | 2022-11-07 | 2023-02-25 |
| homelosite[.]com | 2022-11-09 | 2023-02-25 |
| zooloow[.]com | 2022-11-10 | 2023-02-25 |
| kidzlande[.]com | 2022-11-10 | 2023-02-25 |
| studiesutshifts[.]com | 2022-11-10 | 2023-02-25 |
| stylelifees[.]com | 2022-11-11 | 2023-02-25 |
| skyphotogreen[.]com | 2022-11-11 | 2023-02-25 |
| gardenearthis[.]com | 2023-01-11 | 2023-02-25 |
| fullstorelife[.]com | 2023-01-11 | 2023-02-25 |
| incollegely[.]org | 2022-05-24 | 2023-01-20 |
| shoplifys[.]com | 2022-05-26 | 2023-01-20 |
| thetimespress[.]com | 2022-06-24 | 2023-01-20 |
| studyshifts[.]com | 2022-06-24 | 2023-01-20 |
| codinerom[.]com | 2022-07-10 | 2023-01-20 |
| gamingcolonys[.]com | 2022-07-17 | 2023-01-20 |
| kidzalnd[.]org | 2022-07-17 | 2023-01-20 |
| wildhour[.]store | 2022-07-26 | 2023-01-20 |
| wilddog[.]site | 2022-07-26 | 2023-01-20 |
| garilc[.]com | 2022-07-26 | 2023-01-20 |
| runningandbeyond[.]org | 2022-08-04 | 2023-01-20 |
| fullmoongreyparty[.]org | 2022-08-04 | 2023-01-20 |
| greenrunners[.]org | 2022-08-04 | 2023-01-20 |
| sunsandlights[.]com | 2022-08-09 | 2023-01-20 |
| techpowerlight[.]com | 2022-08-16 | 2023-01-20 |
| gamezess[.]com | 2022-08-29 | 2023-01-20 |
| planningly[.]org | 2022-08-29 | 2023-01-20 |
| luxario[.]org | 2022-09-03 | 2023-01-20 |
| vinoneros[.]com | 2022-09-03 | 2023-01-20 |
| i-reality[.]online | 2022-09-07 | 2023-01-20 |
| styleanature[.]com | 2022-09-07 | 2023-01-20 |
| planetosgame[.]com | 2022-12-12 | 2023-01-20 |
| kidsfunland[.]org | 2022-07-29 | 2023-01-19 |
| fullstorelife[.]com | 2022-11-11 | 2023-01-09 |
| localtallk[.]store | 2022-01-26 | 2022-12-20 |
| allplaces[.]online | 2022-01-26 | 2022-12-20 |
| sunclub[.]site | 2022-01-26 | 2022-12-20 |
| thenewsfill[.]com | 2022-05-26 | 2022-12-20 |
| wellnessjane[.]org | 2022-05-26 | 2022-12-20 |
| meehealth[.]org | 2022-05-27 | 2022-12-20 |
| gameizes[.]com | 2022-07-20 | 2022-12-20 |
| playozas[.]com | 2022-07-20 | 2022-12-20 |
| foodyplates[.]com | 2022-07-20 | 2022-12-20 |
| designaroo[.]org | 2022-08-29 | 2022-12-20 |
| designspacing[.]org | 2022-08-29 | 2022-12-20 |
| stockstiming[.]org | 2022-09-01 | 2022-12-20 |
| hoteliqo[.]com | 2022-09-01 | 2022-12-20 |
| projectoid[.]org | 2022-09-01 | 2022-12-20 |
| study-search[.]com | 2022-09-01 | 2022-12-20 |
| tokenberries[.]com | 2022-09-03 | 2022-12-20 |
| recovery-plan[.]org | 2022-09-07 | 2022-12-20 |
| deliverystorz[.]com | 2022-09-07 | 2022-12-20 |
| forestaaa[.]com | 2022-10-04 | 2022-12-20 |
| addictmetui[.]com | 2022-10-20 | 2022-12-20 |
| earthyouwantiis[.]com | 2022-10-20 | 2022-12-20 |
| zedforme[.]com | 2022-10-20 | 2022-12-20 |
| forestaaa[.]com | 2022-10-28 | 2022-12-20 |
| navadatime[.]com | 2022-11-10 | 2022-12-15 |
| careers4ad[.]com | 2022-11-13 | 2022-12-15 |
| gardenearthis[.]com | 2022-11-07 | 2022-12-14 |
| studyreaserch[.]com | 2022-11-09 | 2022-12-14 |
| novinite[.]biz | 2022-08-31 | 2022-12-10 |
| agronomsdoc[.]com | 2022-11-16 | 2022-11-28 |
| whiteandpiink[.]com | 2022-11-16 | 2022-11-28 |
| nutureheus[.]com | 2022-11-18 | 2022-11-28 |
| dressuse[.]com | 2022-09-18 | 2022-11-20 |
| iwoodstor[.]xyz | 2022-09-18 | 2022-11-20 |
| teachlearning[.]org | 2022-09-18 | 2022-11-20 |
| subcloud[.]online | 2022-09-21 | 2022-11-20 |
| monvesting[.]com | 2022-09-21 | 2022-11-20 |
| elektrozi[.]com | 2022-09-21 | 2022-11-20 |
| hoteluxurysm[.]com | 2022-11-09 | 2022-11-14 |
| hopsite[.]online | 2022-11-13 | 2022-11-14 |
| bikersrental[.]com | 2022-05-24 | 2022-11-13 |
| takestox[.]com | 2022-05-24 | 2022-11-13 |
| sidelot[.]org | 2022-05-24 | 2022-11-13 |
| powercodings[.]com | 2022-08-21 | 2022-11-13 |
| naturemeter[.]org | 2022-08-21 | 2022-11-13 |
| takebreak[.]io | 2022-10-12 | 2022-11-13 |
| fullstorelife[.]com | 2022-11-07 | 2022-11-10 |
| noraplant[.]com | 2022-11-09 | 2022-11-09 |
| forestaaa[.]com | 2022-10-04 | 2022-11-07 |
| goodsforuw[.]com | 2022-10-26 | 2022-11-07 |
| stayle[.]co | 2022-10-26 | 2022-11-07 |
| eedloversra[.]online | 2022-10-28 | 2022-11-07 |
| sevensdfe[.]com | 2022-11-03 | 2022-11-07 |
| dsudro[.]com | 2022-11-03 | 2022-11-07 |
| gameboysess[.]com | 2022-11-07 | 2022-11-07 |
| sseamb[.]com | 2022-10-26 | 2022-11-06 |
| healthcovid19[.]com | 2022-11-04 | 2022-11-06 |
| noraplant[.]com | 2022-11-04 | 2022-11-06 |
| fullstorelife[.]com | 2022-11-04 | 2022-11-06 |
| datacentertime[.]com | 2022-11-04 | 2022-11-05 |
| recover-your-body[.]xyz | 2022-01-06 | 2022-11-02 |
| reloadyourbrowser[.]info | 2022-07-05 | 2022-11-02 |
| comeandpet[.]me | 2022-07-05 | 2022-11-02 |
| brushyourteeth[.]online | 2022-07-05 | 2022-11-02 |
| digital-mar[.]com | 2022-08-10 | 2022-11-02 |
| retailmark[.]net | 2022-08-16 | 2022-11-02 |
| dsudro[.]com | 2022-10-04 | 2022-11-02 |
| studysliii[.]com | 2022-10-26 | 2022-11-02 |
| homeigardens[.]com | 2022-09-07 | 2022-10-29 |
| stayle[.]co | 2022-10-20 | 2022-10-24 |
| studysliii[.]com | 2022-10-20 | 2022-10-24 |
| goodsforuw[.]com | 2022-10-20 | 2022-10-24 |
| dsudro[.]com | 2022-10-20 | 2022-10-24 |
| sseamb[.]com | 2022-10-20 | 2022-10-24 |
| sevensdfe[.]com | 2022-10-20 | 2022-10-24 |
| koraliowe[.]com | 2022-04-05 | 2022-10-13 |
| topuprr[.]com | 2022-04-05 | 2022-10-13 |
| zeebefg[.]com | 2022-04-05 | 2022-10-12 |
| takebreak[.]io | 2022-06-21 | 2022-10-11 |
| forestaaa[.]com | 2022-10-03 | 2022-10-03 |
| teachlearning[.]org | 2022-09-18 | 2022-09-18 |
| newsbuiltin[.]online | 2022-09-15 | 2022-09-17 |
| jyfa[.]xyz | 2022-09-15 | 2022-09-17 |
| monvesting[.]com | 2022-07-19 | 2022-09-15 |
| teachlearning[.]org | 2022-07-19 | 2022-09-15 |
| elektrozi[.]com | 2022-07-20 | 2022-09-15 |
| thepila[.]com | 2022-09-15 | 2022-09-15 |
| thegreenlight[.]xyz | 2022-01-11 | 2022-09-14 |
| gosport24[.]com | 2022-01-11 | 2022-09-14 |
| classiccolor[.]live | 2022-01-11 | 2022-09-11 |
| shoeszise[.]xyz | 2022-02-24 | 2022-09-11 |
| cleanitgo[.]info | 2022-02-24 | 2022-09-11 |
| setclass[.]live | 2022-02-24 | 2022-09-11 |
| white-rhino[.]online | 2022-04-14 | 2022-09-11 |
| space-moon[.]com | 2022-04-14 | 2022-09-11 |
| enrollering[.]com | 2022-05-24 | 2022-09-11 |
| newslocalupdates[.]com | 2022-08-19 | 2022-09-11 |
| newsbuiltin[.]online | 2022-09-11 | 2022-09-11 |
| beendos[.]com | 2022-04-14 | 2022-09-10 |
| linestrip[.]online | 2022-07-01 | 2022-09-07 |
| sunnyweek[.]site | 2022-07-01 | 2022-09-07 |