India CERT-In Cyber Advisories Brief

Headline

CERT-In issues advisory on Apple mercenary spyware threat notifications affecting Indian device users

Executive Summary

India's Computer Emergency Response Team issued Advisory CIAD-2026-0039 on August 14, 2026, in direct response to Apple's global threat notifications warning of mercenary spyware targeting Apple devices. The advisory directs affected users to preserve device state, apply specified software updates, and contact CERT-In for technical examination.

Bottom Line

CERT-In's advisory creates a bifurcated obligation for Apple device users in India who have received threat notifications: they are prohibited from modifying their devices in any way before engaging CERT-In for forensic examination, while simultaneously being directed to apply iOS 26.6 and enable Lockdown Mode once that examination pathway is initiated. Users who have not received threat notifications are subject to the advisory's standing directive to monitor CERT-In Vulnerability Notes and apply patches as published. The evidence-preservation prohibition is the operative constraint that governs sequencing for all affected recipients.

Key Regulatory Signals

• Apple Threat Notifications Reach Indian Users: Apple has issued threat notifications to users in India and globally, warning of sophisticated mercenary spyware attempts attributed to state-sponsored or highly resourced adversaries targeting Apple devices. Recipients of these notifications are the primary affected population.
• Specific Software Versions Mandated: CERT-In directs affected users to update to iOS 26.6 as the minimum required version, with all other Apple devices to be upgraded to their respective current software releases. Messaging and cloud applications must also be updated to their most recent versions.
• Lockdown Mode Activation Required for At-Risk Users: Users who have received Apple threat notifications are directed to enable Lockdown Mode on their devices, a high-restriction operating state Apple provides specifically to counter advanced spyware threats.
• Evidence Preservation Obligation Before Any Device Action: CERT-In explicitly prohibits affected users from resetting, deleting applications, updating, or restarting their devices before forensic examination, on the basis that such actions destroy evidence. Users must contact CERT-In at submitmobile@cert-in.org.in before taking any remedial steps.
• Ongoing Patch Compliance Directed Across the User Base: Beyond the immediate spyware context, CERT-In directs all users to consult its published Vulnerability Notes and Advisories on a regular basis and apply security patches as issued, establishing a continuing compliance expectation rather than a one-time remediation.

Regulatory Delta

- No direct CERT-In precedent exists for an advisory responding specifically to Apple's mercenary spyware threat notification program. This is the first known coordination between Apple's private threat intelligence disclosure mechanism and a national CERT response.

- The advisory introduces an evidence-preservation requirement that bars device modification before forensic contact. This is a procedural departure from the patch-and-update guidance CERT-In typically issues.

- The advisory references CERT-In's broader digital infrastructure defense framework, including guidance for MSMEs and standards for hardware bills of materials, signaling that this incident has been folded into a wider national cyber-resilience effort.

Materiality Classification

HIGH — This action carries confirmed regulatory impact beyond its home jurisdiction.

Intelligence Outlook

Monitor CERT-In for follow-on technical advisories or forensic findings arising from device examinations conducted under this advisory, and for any escalation of the mercenary spyware threat classification affecting broader enterprise or government device populations.