ZecOps - A Jamf Company

Cutting-edge Mobile XDR / DFIR solution for iOS & Android.

#MobileXDR #MobileDFIR #Infosec

[ZecOps - A Jamf Company @ZecOps]

Demo: https://t.co/NRnLmq4Cz4

[Omer Benjakob @omerbenj]

In first, Israeli citizen found to have been infected by Pegasus twice in the past two years. Unclear why the man, who is active in the protests against Netanyhu, was targeted and by who. Forensics by @JamfSoftware @ZecOps @citizenlab

https://t.co/CLfZTSIlei

[Jamf @JamfSoftware]

Attention all mobile users! 📱🚨 It’s important to stay informed about the latest threats to your device. Check out our latest blog post to learn about the evolution of mobile #spyware and how you can protect yourself. https://t.co/adzJU5Gevh
#cybersecurity #JamfThreatLabs

[Jamf @JamfSoftware]

Using Jamf to #automate more workflows can empower your organization to increase productivity without hiring new workers. Listen to what our customers have to say! If you need to do more with less, request a #trial of Jamf today. https://t.co/EEuCEPootS
#ITAdmin #Apple #Tech

[Jamf @JamfSoftware]

Introducing AWS Verified Access! This integration improves organizational #security by enhancing threat prevention measures and reducing the risk of data breaches, all while simplifying security controls.
Learn more in our press release. https://t.co/iausohmXAi

[Dean Hager @deanhager]

Welcome to the @ZecOps team! We are @JamfSoftware are so excited to work together to reimagine Management and Security for @Apple at Work — simplifying the workplace while securing the enterprise!

[ZecOps - A Jamf Company @ZecOps]

@rachelnauen @JamfSoftware Thank you @rachelnauen!

[ZecOps - A Jamf Company @ZecOps]

Exciting announcement: Jamf completes acquisition of ZecOps, extending its mobile security capabilities by adding advanced detections and incident response for iOS!

https://t.co/N6ChkV6eBb @JamfSoftware

[ZecOps - A Jamf Company @ZecOps]

From #OBTS conference today: Ian Beer from @projectzero mentioned that CVE-2020-9907 was exploited in the wild. Thanks to @ZecOps @08Tc3wBB CVE-2020-9907 was reported to @Apple and patched, and will not be used against any iOS user that updated their device!

[Dean Hager @deanhager]

Are you ready #JamfNation?

#JNUC2022 Together again

[Jamf @JamfSoftware]

We announced plans to acquire @ZecOps, a leading mobile #security solution designed to discover and analyze the most sophisticated cyber attacks on mobile devices.

[ZecOps - A Jamf Company @ZecOps]

We are excited to join forces with @JamfSoftware to offer customers truly powerful mobile threat hunting capabilities without compromising the user experience or violating their personal privacy. Exciting times ahead!

https://t.co/5f1kMgBZLc

cc: @ihackbanme @deanhager

[ZecOps - A Jamf Company @ZecOps]

Don't have access yet? Contact us here https://t.co/UXWePiQDhP

[ZecOps - A Jamf Company @ZecOps]

ZecOps for Mobile is now fully supporting iOS 16 (including Lockdown Mode!)

[ZecOps - A Jamf Company @ZecOps]

iOS 15.7 is out and it fixed CVE-2022-32917 which was likely exploited in the wild. Update as soon as you can. https://t.co/k3NleSMjWd

[ZecOps - A Jamf Company @ZecOps]

Please note: processes used as IOCs have limited value. In most cases, attackers can change the names.
The folks from Amnesty Tech had done an impressive job in their research, and trying to prove anything due to a lack of clarification on uppercase/lowercase is ridiculous.

[ZecOps - A Jamf Company @ZecOps]

[Pegasus IOCs Update] One of the Pegasus IOCs included a process named 'diagnosticd'.
If you found this process on your phone: don't panic!
This process is a default iOS process (located at /usr/libexec/diagnosticd).

[ZecOps - A Jamf Company @ZecOps]

For clarity:
Amnesty referred to 'Diagnosticd' with uppercase D. We referred to 'diagnosticd' with lowercase D. If you are seeing 'diagnosticd' in /usr/libexec it is a legitimate process. If you've observed 'Diagnosticd' in any folder, per Amnesty's note, it could be malicious.

[ZecOps - A Jamf Company @ZecOps]

@1njection Yes!

[Zuk @ihackbanme]

Remember: WebKit+Kernel exploit that is delivered via AdNetwork == 0-click water-holing attack.
For mobile devices specifically, it is (very) dangerous out there and 99.9% of device-owners and businesses don't even know what *processes* are running on your phones.

[ZecOps - A Jamf Company @ZecOps]

We see similar attacks often and can help to provide visibility to iPhones and iPads.

Contact us here if you need help: https://t.co/UXWePiyu3H

[ZecOps - A Jamf Company @ZecOps]

[IMPORTANT] Using an iPhone or iPad? make sure to update to the latest iOS and iPadOS that fixes two vulnerabilities that may have been exploited in the wild in one-click and potentially also zero-click attacks!
More details on Apple's website: https://t.co/4Ik9WKgqf9