Apple 99 mamlakat bo'ylab foydalanuvchilarga yangi tahdid bildirishnomalari yuborishni boshladi va ularni maqsadli yollangan josuslik dasturlari (mercenary spyware) hujumlari haqida ogohlantirmoqda, deb xabar berdi kiberxavfsizlik tadqiqotchisi Costin Raiu. O'z postida Raiu bu bildirishnomalar yangi hujumlar bilan bog'liq ekanligini va avgust oyida yuborilgan ogohlantirishlar to'lqinidan alohida ekanligini ta'kidladi.
Raiu keltirgan bildirishnomada shunday deyiladi: "Bugungi bildirishnoma 99 mamlakatdagi maqsadli foydalanuvchilarga yuborilmoqda va hozirgacha biz jami 150 dan ortiq mamlakatdagi foydalanuvchilarga xabar berdik."
Apple'ning e'lon qilingan yo'riqnomasi uning 2021-yildan beri faoliyat yuritib kelayotgan bildirishnoma dasturining umumiy qamrovini tasdiqlaydi. Biroq, qo'llab-quvvatlash hujjati yangi xabar qilingan 99 mamlakat bilan bog'liq taqsimotni aniqlashtirmaydi.
Apple bu bildirishnomalarni yuqori ishonchli ogohlantirishlar sifatida ta'riflaydi, ya'ni shaxs yollangan josuslik dasturi bilan maqsadli hujumga uchragan. Ular jiddiy qabul qilinishi kerak, ammo ogohlantirish olish hujumchilar qurilmani muvaffaqiyatli buzib kirganini anglatmaydi. Apple o'z tekshiruvlari mutlaq aniqlikka erisha olmasligini tan oladi.
Kompaniya shubhali faoliyatni aniqlash uchun ichki tahdid razvedkasi va tekshiruvlarga tayanadi. Uning yollangan josuslik dasturlari haqidagi ogohlantirishlari keng tarqalgan zararli dasturlar emas, balki yuqori darajada tanlangan kuzatuv operatsiyalariga tegishli bo'lib, maqsadlar ehtimol ularning shaxsi yoki kasbiy faoliyati tufayli tanlangan bo'lishi mumkin.
Yangi bildirishnomalar avgust oyida 110 mamlakat bo'ylab yuborilgan ogohlantirishlardan keyin kelmoqda. Bu raqamlar alohida bildirishnoma to'lqinlarini ifodalaydi, ya'ni ular turli jabrlanuvchi aholini anglatmaydi. Ularni noyob ta'sirlangan mamlakatlar sonini hisoblash uchun qo'shib bo'lmaydi.
Keltirilgan xabarda josuslik dasturi sotuvchisi, foydalanilgan zaiflik, yetkazib berish mexanizmi yoki mas'ul hukumat aniqlanmagan. Apple bu hujumlar yoki bildirishnomalarni ma'lum hujumchilar yoki geografik hududlarga bog'lashdan aniq ravishda qochadi.
Taqqoslanadigan tekshiruvlar bu to'lqinning hujumchilarini aniqlamasdan texnik xavflarni ko'rsatadi. Jurnalistlarga qarshi Graphite josuslik dasturi hujumlarini o'rgangan tadqiqotchilar CVE-2025-43200 bilan bog'liq iMessage nol-bosish (zero-click) ekspluatatsiyasini hujjatlashtirgan. Bu alohida holat foydalanuvchining hech qanday o'zaro ta'sirini talab qilmagan va iOS xavfsizlik yangilanishi orqali bartaraf etilgan. Bu yerda keltirilgan hech qanday dalil Graphite'ni so'nggi bildirishnomalar bilan bog'lamaydi.
Qabul qiluvchilar ogohlantirishlarni o'z Apple hisobiga qo'lda kirish orqali tekshirishlari kerak, bu yerda bildirishnoma banneri paydo bo'ladi. Apple shuningdek, ogohlantirishlarni elektron pochta orqali va qo'llab-quvvatlanadigan iPhone'larda to'g'ridan-to'g'ri yetkazib beradi.
Diqqat: Apple Threat Notifications'ning yangi to'lqini hozir yuborilmoqda, avgust to'lqinidan alohida va yangi hujumlar bilan bog'liq!
Apple'ning xabari:
"Bugungi bildirishnoma 99 mamlakatdagi maqsadli foydalanuvchilarga yuborilmoqda va hozirgacha biz jami 150 dan ortiq mamlakatdagi foydalanuvchilarga xabar berdik..." pic.twitter.com/sBEA3VTFHl
— Costin Raiu (@craiu) 30-oktabr, 2026
Apple'ning rasmiy himoya yo'riqnomasi Lockdown Mode'ni yoqishni va mutaxassis yordamiga murojaat qilishni tavsiya qiladi, jumladan Access Now'ning Digital Security Helpline, bu kecha-kunduz mavjud.
Haqiqiy bildirishnomalar hech qachon parollar, tasdiqlash kodlari, ilovalarni o'rnatish, konfiguratsiya profillari yoki fayllarni yuklab olishni so'ramaydi. Bunday har qanday so'rovni shubhali deb hisoblang va Apple ogohlantirish jarayonining bir qismi sifatida unga amal qilmang.
SOC'ga hodisalarni tez to'xtatish uchun ogohlantirish kontekstini bering. 16K SOC'dan tahdid razvedkasini integratsiya qiling.
Apple has started sending a new round of threat notifications to users across 99 countries, warning them about targeted mercenary spyware attacks, according to cybersecurity researcher Costin Raiu. In his post, Raiu noted that these notifications are related to new attacks and are separate from the wave of alerts sent out in August.
The notification quoted by Raiu states: “Today’s notification is being sent to targeted users in 99 countries, and to date, we have notified users in over 150 countries in total.”
Apple’s published guidance confirms the overall reach of its notification program, which has operated since 2021. However, the support document does not specify the distribution related to the newly reported 99 countries.
Apple describes these notifications as high-confidence warnings that an individual has been targeted by mercenary spyware. They should be taken seriously, but receiving an alert does not establish that attackers successfully compromised the device. Apple acknowledges that its investigations cannot achieve absolute certainty.
The company relies on internal threat intelligence and investigations to identify suspicious activity. Its mercenary spyware warnings concern highly selective surveillance operations rather than indiscriminate malware distribution, with targets potentially selected because of their identity or professional activities.
The new notifications follow alerts issued across 110 countries in August. Those figures describe separate notification rounds, not necessarily different victim populations. They should not be added together to calculate unique affected countries.
The quoted notice does not identify a spyware vendor, exploited vulnerability, delivery mechanism, or responsible government. Apple explicitly avoids attributing these attacks or notifications to particular attackers or geographic regions.
Comparable investigations illustrate the technical risks without identifying this wave’s attackers. Researchers examining Graphite spyware attacks against journalists documented an iMessage zero-click exploit involving CVE-2025-43200. That separate case required no user interaction and was addressed through an iOS security update. No evidence supplied here connects Graphite to the latest notifications.
Recipients should verify alerts by manually signing into their Apple Account, where a notification banner appears. Apple also delivers warnings through email and directly on supported iPhones. Heads-up: New round of Apple Threat Notifications is going out right now, distinct from the August wave and tied to new attacks!
Apple’s notice:
“Today’s notification is being sent to targeted users in 99 countries, and to date we have notified users in over 150 countries in… pic.twitter.com/sBEA3VTFHl
— Costin Raiu (@craiu) October 30, 2026
Apple’s official protection guidance recommends enabling Lockdown Mode and seeking specialist assistance, including Access Now’s Digital Security Helpline, available around the clock.
Authentic notifications never request passwords, verification codes, application installations, configuration profiles, or file downloads. Treat any such request as suspicious rather than following it as part of Apple’s warning process.
Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.