Security researcher Justin.sh has published a detailed report examining a confidential corporate document belonging to digital forensics firm Cellebrite that was recently leaked online. The document sheds light on a newly introduced software offering called "Advanced Unlocks," which appears to be designed to bypass security measures on modern mobile devices, raising significant questions within the cybersecurity community regarding the potential use of zero-day exploits targeting hardware and firmware components like smartphone radios.
According to the analysis published on Justin.sh’s blog, Cellebrite is utilizing the acronym "AU" to designate this new offering, formally known as Advanced Unlocks. The researcher points out that this terminology should not be confused with the generalized "advanced unlocking services" that the forensics company has actively marketed to law enforcement agencies and government clients for years. Corporate records and public announcements confirm that AU represents a distinct, formal product rollout for 2026. This follows leadership changes at the firm, including a press release from earlier in the year confirming the appointment of Shiven Ramji as Chief Executive Officer, succeeding Thomas E. Hogan.
The distinction between standard digital extraction techniques and the capabilities hinted at in the leaked material centers around device security states, specifically the status of a phone after an initial reboot. In mobile security parlance, AFU refers to the state "after first unlock," a condition where a device has been unlocked by its user at least once since powering on, leaving certain cryptographic keys accessible in memory to facilitate convenience features and notifications. In contrast, BFU—"before first unlock"—represents a much more secure state where the device’s storage is heavily encrypted and standard access methods are largely ineffective unless a vulnerability in the bootloader, operating system, or radio firmware can be leveraged.
The leaked document suggests that Cellebrite’s Advanced Unlocks product is engineered to tackle difficult access scenarios on modern smartphones, most notably Apple’s iPhone lineup. Because Apple has continuously hardened iOS and its underlying hardware against traditional extraction tools, forensic vendors must constantly discover or purchase previously unknown software vulnerabilities, commonly referred to as zero-day exploits, to maintain their competitive edge in the law enforcement market. The possibility that AU relies on a radio-based zero-day vulnerability has sparked intense speculation among independent security researchers who closely monitor the ecosystem of offensive security tools.
Radio components in modern smartphones, including baseband processors, Wi-Fi chips, and Bluetooth controllers, operate using complex firmware that runs completely independently of the primary operating system. These radio stacks handle vast amounts of incoming and outgoing data, making them prime targets for remote or proximity-based exploitation. If an unlocking tool can interact with these components to execute arbitrary code or bypass security layers without requiring physical interaction with the device’s main application processor, it represents a formidable capability for forensic extraction, but it also highlights a critical vulnerability that affects the broader ecosystem.
The cybersecurity community has long scrutinized the intersection between corporate forensic tools and the commercial spyware market. Companies like Cellebrite position their products as lawful intercept and investigation aids provided exclusively to military, law enforcement, and intelligence agencies to combat serious crime and terrorism. However, the reliance on advanced zero-day vulnerabilities means these companies operate in a grey market where software flaws must be discovered, weaponized, and maintained until patched by the original equipment manufacturers. When internal documents regarding these products leak, they provide a rare window into the technical arms race happening behind the scenes between tech giants striving to protect user privacy and forensic firms attempting to bypass those protections.
As the details of the leak continue to circulate, security analysts are examining the potential implications for iPhone security. Apple routinely issues security updates to patch vulnerabilities reported by internal engineers and external researchers, but the discovery of specialized forensic tools utilizing novel attack vectors often prompts accelerated defensive engineering. Neither Cellebrite nor Apple has issued a comprehensive public statement addressing the specifics of the leaked document, leaving the cybersecurity sector to rely on independent analyses such as the one provided by Justin.sh to understand the evolving landscape of mobile device security and exploitation techniques.
Cyber Security & Cryptography
Cyber Security & Cryptography
Cyber Security & Cryptography
