- Engineer — Act: Actively exploited zero-day in CoreGraphics affecting iOS (and likely macOS per related advisories); update all managed Apple devices to the patched iOS/macOS releases immediately via MDM or manual prompt.
- SOC/IR — Plan: No IOCs or ATT&CK-mapped TTPs are available yet; queue a sweep of MDM inventory to identify unpatched Apple devices among high-value personnel and prepare to triage if Apple releases indicators for this ’extremely sophisticated’ campaign.
- Leader — Act: Sophisticated targeted iOS zero-days historically indicate mercenary or state-sponsored spyware against executives and high-value individuals; confirm MDM enforces the patch on corporate Apple devices and brief leadership who use personal iPhones for work on the need to update immediately.