POISON_CARP__2020__Evil_Eye_Threat_Actor_Resurfaces_with_iOS_Exploit_and_Updated_Implant.pdf

Volexity documents the resurgence of the Evil Eye threat actor using the IRONSQUIRREL framework to deliver an undocumented iOS WebKit exploit against iOS 12.3/12.3.1/12.3.2; successful exploitation drops the INSOMNIA implant which runs as root, exfiltrates data (including Signal and ProtonMail artifacts), performs HTTPS C2 communication with embedded certificate validation, and is distributed via compromised Uyghur-focused websites—appendices include C2 IPs, hostnames, malware hashes, and embedded certificate details.