Evil Eye

Evil Eye is the name Volexity uses for a state-sponsored, China-nexus threat actor involved in surveillance and exploitation campaigns targeting Uyghur communities. Volexity identified Evil Eye as the most notable actor in its reporting on large-scale attacks against Uyghurs and assessed it was likely the same group behind iOS implant exploitation previously described by Google Project Zero. The actor was observed compromising Uyghur websites and using malicious iframes plus the open-source IRONSQUIRREL framework to deliver WebKit-based iOS exploit chains. In activity observed from January to March 2020, the exploit chain targeted iOS 12.3, 12.3.1, and 12.3.2 and installed an iOS implant Volexity calls INSOMNIA. The exploit flow used User-Agent filtering, staged JavaScript, and ultimately executed a Mach-O payload that wrote the implant to /tmp/updateserver and ran it as root with elevated entitlements. Volexity also reported that Evil Eye had previously been observed launching an exploit intended to install a malware implant on Android phones. The updated INSOMNIA implant used HTTPS for C2 with embedded-certificate validation, basic string obfuscation, and targeted data from applications including Signal, ProtonMail, and WeChat. Following public reporting in September 2019, Evil Eye activity temporarily decreased and included removal of malicious code from compromised websites and takedown of C2 infrastructure, before resuming in early 2020.