Jul 24, 2023
1 new incident, 1 with updates.
Started
- ClosedPatched
Ivanti EPMM zero-days used to breach 12 Norwegian ministries
APT actors exploited an unauthenticated API access bug in Ivanti Endpoint Manager Mobile (formerly MobileIron Core) as a zero-day from at least April 2023. They used it to break into the shared IT platform of 12 Norwegian government ministries, possibly chaining it with a file-write bug (CVE-2023-35081).
Ivanti Endpoint Manager Mobile (EPMM / MobileIron Core)Closed Aug 15, 2023
Updated
- ClosedPatched
Operation Triangulation: zero-click iMessage spyware on Kaspersky's iPhones
Kaspersky found a years-long zero-click iMessage campaign on its own staff's iPhones. The chain used several Apple zero-days, including a bypass of hardware memory protections through undocumented MMIO registers (CVE-2023-38606), which was revealed at 37C3 in December 2023.
Apple iOS (and other Apple OSes sharing the bugs)Closed Dec 27, 2023
