[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$frY1VhhMTyek7A-0N7RlFnjata5Or-_DhC6qBxYlMz7E":3},{"article":4,"iocs":45,"watch_terms":49,"solutions":50,"lesson":136},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"0dde89f4-3ad3-4cd8-a2b2-93df76a962b2","Apple’s spyware notifications reach the Bundestag: what the BSI says to do now","apple-s-spyware-notifications-reach-the-bundestag-what-the-bsi-says-to-do-now-bf12ba","Apple warns German Bundestag lawmakers of mercenary spyware attacks; BSI urges victims to assume compromise. The German government is warning politicians and public figures that they were targeted by government-backed spyware. The warning follows Apple’s notifications, which began reaching iPhones on October 29, according to the federal cybersecurity office, the BSI. The BSI says members […]","Apple has notified German Bundestag lawmakers and other public figures of potential mercenary spyware attacks. The German Federal Office for Information Security (BSI) confirmed the alerts and advised affected individuals to assume their devices may be compromised, as the notifications do not confirm successful infections. The BSI recommends immediate operating system updates and considering Lockdown Mode.","Apple warns German lawmakers of mercenary spyware; BSI urges victims to assume compromise.","https:\u002F\u002Fsecurityaffairs.com\u002F202297\u002Fintelligence\u002Fapples-spyware-notifications-reach-the-bundestag-what-the-bsi-says-to-do-now.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2015\u002F05\u002FBundestag.jpg","2026-11-03T06:24:38+00:00","2026-11-03T07:00:36.704078+00:00",8,[17,20,23,25],{"name":18,"type":19},"Apple","vendor",{"name":21,"type":22},"iPhone","product",{"name":24,"type":19},"BSI",{"name":26,"type":22},"Lockdown Mode","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":27,"icon":29,"name":30,"slug":31},null,"Nation-state","nation-state",[33,35,40],{"category":34},{"id":27,"icon":29,"name":30,"slug":31},{"category":36},{"id":37,"icon":29,"name":38,"slug":39},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[46],{"type":39,"value":47,"context":48},"mercenary spyware","Type of advanced, commercially developed spyware used in attacks against targeted individuals.",[18,24,21],{"controls":51,"vendors":130},[52,80,101],{"slug":53,"name":54,"problem":55,"products":56},"patch-management","Automated patch management","Known holes get closed in days, not months.",[57,65,72],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":53,"product_name":69,"url":70,"description":71},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":81,"name":82,"problem":83,"products":84},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[85,93],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":102,"name":103,"problem":104,"products":105},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[106,114,122],{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",[131],{"slug":132,"name":18,"logo_path":133,"roles":134},"apple","\u002Fvendor-logos\u002Fapple.png",[135],"reported_by",{"slug":137,"title":138,"body":139,"framework_refs":140,"framework_notes":148},"mercenary-spyware-targets-german-lawmakers-act-on-apple-threat-notifications-now","Mercenary Spyware Targets German Lawmakers: Act on Apple Threat Notifications Now","Apple's threat notification system flagged potential mercenary spyware attacks against German Bundestag members and other high-profile individuals, with the BSI urging recipients to treat their devices as potentially compromised. This incident highlights that even sophisticated users in positions of power can be targeted by nation-state-level spyware tools such as Pegasus, which exploit zero-day or unpatched vulnerabilities. The fact that the BSI had to instruct officials to update their operating systems immediately underscores a persistent gap in timely patch adoption, especially among non-technical but high-value targets. It matters because compromised devices belonging to lawmakers can expose classified deliberations, diplomatic communications, and sensitive constituent data, with far-reaching national security consequences.",[141,142,143,144,145,146,147],"CIS Control 7: Continuous Vulnerability Management","CIS Control 17: Incident Response Management","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","MITRE ATT&CK T1566: Phishing",{"NIS2 Article 21(2)(b)":149,"MITRE ATT&CK T1566: Phishing":150,"NIST SP 800-53 SI-2: Flaw Remediation":151,"CIS Control 17: Incident Response Management":152,"CIS Control 7: Continuous Vulnerability Management":153,"CIS Control 14: Security Awareness and Skills Training":154,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":155},"NIS2 requires essential entities—which include government bodies—to implement incident handling procedures; receiving an Apple spyware notification should trigger a documented, tested response under this obligation.","Mercenary spyware such as Pegasus is frequently delivered via zero-click or one-click links sent to targets; understanding this delivery technique informs both technical hardening (Lockdown Mode) and user awareness programmes.","SI-2 mandates that organisations identify, report, and correct information system flaws on defined timelines; enforcing this for government-issued mobile devices would have reduced the window of exploitation.","A pre-established spyware incident response playbook would have given Bundestag IT teams clear steps—device isolation, forensic triage, and secure replacement—rather than relying solely on BSI ad-hoc guidance after alerts arrived.","Regularly scanning for and remediating known vulnerabilities on official devices would have ensured that the OS patches closing the exploited flaws were applied before spyware could gain a foothold.","High-value targets such as lawmakers need tailored training on recognising threat notifications and understanding the immediate protective actions required, rather than waiting for external agencies to advise them.","This control requires timely identification and remediation of technical vulnerabilities across all assets, including mobile endpoints used by high-risk personnel such as elected officials."]