MalwareUsed by 1 actorExploits 1 CVE

FORCEDENTRY

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2021-30860FORCEDENTRY / CoreGraphics JBIG2 Integer Overflow RCE

NSO Group разработала FORCEDENTRY именно для обхода BlastDoor: CoreGraphics обрабатывал PDF внутри BlastDoor, но JBIG2-декодер использовался для построения логических примитивов.

via codebycodeby.net

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

NSO Group

via codebycodeby.net

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1592Gather Victim Host InformationEvidence1

"Defendants executed the FORCEDENTRY exploit first by using their computers to contact Apple servers in the United States and abroad to identify other Apple devices. Defendants contacted Apple servers using their Apple IDs to confirm that the target was using an Apple device."

Initial Access

2 techniques

T1190Exploit Public-Facing ApplicationEvidence1

Adversaries may exploit software vulnerabilities to gain initial access to a mobile device. This can be accomplished in a variety of ways. Vulnerabilities may be present in the applications, the services, the underlying operating system, or the kernel itself.

T1566.001Spearphishing AttachmentEvidence1

By sending a .gif iMessage attachment (which was really a PDF) NSO were able to remotely trigger a heap buffer overflow

Execution

3 techniques

T1059Command and Scripting InterpreterEvidence1

NSPredicates using the FUNCTION keyword are effectively Objective-C scripts.

T1203Exploitation for Client ExecutionEvidence3

The latest Pegasus spyware campaign targeted at least nine Bahraini activists, a French lawyer, and an Indian journalist via a new iOS exploit, dubbed FORCEDENTRY. This was a highly sophisticated zero-click, 0day vulnerability in iMessage.

T1574Hijack Execution FlowEvidence1

the JBIG2 machine builds a fake Objective-C object with a fake isa such that the invocation of the dealloc selector causes the deserialization and evaluation of the NSFunctionExpression

Privilege Escalation

1 technique

T1068Exploitation for Privilege EscalationEvidence1

This NSFunctionExpression has two purposes... it builds a payload NSPredicate object then triggers a logic bug to get that NSPredicate object evaluated in the CommCenter process, reachable from the IMTranscoderAgent sandbox via the com.apple.commcenter.xpc NSXPC service.

Stealth

4 techniques

T1036MasqueradingEvidence1

By sending a .gif iMessage attachment (which was really a PDF)

T1070.004File DeletionEvidence1

This finds the XXX.gif file used to deliver the exploit which iMessage has stored somewhere under the /tmp/com.apple.messages folder and deletes it.

T1574Hijack Execution FlowEvidence1

the JBIG2 machine builds a fake Objective-C object with a fake isa such that the invocation of the dealloc selector causes the deserialization and evaluation of the NSFunctionExpression

T1620Reflective Code LoadingEvidence1

Finally, this fetches the value of the "a" key from the next-stage plist, parses it as an NSExpression string and evaluates it.

Credential Access

1 technique

T1528Steal Application Access TokenEvidence1

"Defendants created more than one hundred Apple IDs using Apple’s systems to be used in their deployment of FORCEDENTRY."

Discovery

2 techniques

T1082System Information DiscoveryEvidence1

[AKDevice _hardwareModel] returns a string like "iPhone12,3"... [AKDevice _buildNumber] returns a string like "18A8395"

T1083File and Directory DiscoveryEvidence1

The FORCEDENTRY exploit was delivered to the Saudi activist’s phone in 31 iMessage attachments sent from the iMessage account [EMAIL ADDRESS 1], based on an analysis of the activist’s phone logs, including their com.apple.identityservices.idstatuscache.plist file.

Lateral Movement

1 technique

T1210Exploitation of Remote ServicesEvidence1

the IMTranscoderAgent sandbox via the com.apple.commcenter.xpc NSXPC service

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

a URL: https://XXX.cloudfront.net/YYY/ZZZ/megalodon?AAA

T1105Ingress Tool TransferEvidence2

The FORCEDENTRY exploit was used to deploy NSO Group’s Pegasus spyware onto the phone of the Saudi activist, and this process involved a file dropped into the Library/Caches folder.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

codebyNews

Jul 12, 2025

Защита смартфона от слежки: GrapheneOS vs Lockdown Mode

Zero-click эксплойт для iPhone, использующий integer overflow в CoreGraphics при обработке PDF с JBIG2-данными; доставлялся через iMessage в виде .gif-файлов, которые фактически были PDF, и позволял компрометацию полностью обновлённых устройств без действий жертвы.

codebyNews

Jul 12, 2025

Zero-click эксплойт: kill chain Pegasus и Predator

Zero-click exploit chain для iMessage, использующая PDF/JBIG2 и integer overflow в CoreGraphics для достижения RCE и обхода защитного механизма BlastDoor на устройствах Apple.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actorExploits 1 CVE

FORCEDENTRY

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2021-30860FORCEDENTRY / CoreGraphics JBIG2 Integer Overflow RCE

via codebycodeby.net

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

NSO Group

via codebycodeby.net

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1592Gather Victim Host InformationEvidence1

Initial Access

2 techniques

T1190Exploit Public-Facing ApplicationEvidence1

T1566.001Spearphishing AttachmentEvidence1

By sending a .gif iMessage attachment (which was really a PDF) NSO were able to remotely trigger a heap buffer overflow

Execution

3 techniques

T1059Command and Scripting InterpreterEvidence1

NSPredicates using the FUNCTION keyword are effectively Objective-C scripts.

T1203Exploitation for Client ExecutionEvidence3

T1574Hijack Execution FlowEvidence1

the JBIG2 machine builds a fake Objective-C object with a fake isa such that the invocation of the dealloc selector causes the deserialization and evaluation of the NSFunctionExpression

Privilege Escalation

1 technique

T1068Exploitation for Privilege EscalationEvidence1

Stealth

4 techniques

T1036MasqueradingEvidence1

By sending a .gif iMessage attachment (which was really a PDF)

T1070.004File DeletionEvidence1

This finds the XXX.gif file used to deliver the exploit which iMessage has stored somewhere under the /tmp/com.apple.messages folder and deletes it.

T1574Hijack Execution FlowEvidence1

the JBIG2 machine builds a fake Objective-C object with a fake isa such that the invocation of the dealloc selector causes the deserialization and evaluation of the NSFunctionExpression

T1620Reflective Code LoadingEvidence1

Finally, this fetches the value of the "a" key from the next-stage plist, parses it as an NSExpression string and evaluates it.

Credential Access

1 technique

T1528Steal Application Access TokenEvidence1

"Defendants created more than one hundred Apple IDs using Apple’s systems to be used in their deployment of FORCEDENTRY."

Discovery

2 techniques

T1082System Information DiscoveryEvidence1

[AKDevice _hardwareModel] returns a string like "iPhone12,3"... [AKDevice _buildNumber] returns a string like "18A8395"

T1083File and Directory DiscoveryEvidence1

Lateral Movement

1 technique

T1210Exploitation of Remote ServicesEvidence1

the IMTranscoderAgent sandbox via the com.apple.commcenter.xpc NSXPC service

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

a URL: https://XXX.cloudfront.net/YYY/ZZZ/megalodon?AAA

T1105Ingress Tool TransferEvidence2

The FORCEDENTRY exploit was used to deploy NSO Group’s Pegasus spyware onto the phone of the Saudi activist, and this process involved a file dropped into the Library/Caches folder.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

codebyNews

Jul 12, 2025

Защита смартфона от слежки: GrapheneOS vs Lockdown Mode

codebyNews

Jul 12, 2025

Zero-click эксплойт: kill chain Pegasus и Predator

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.