Scan iPhone backups for traces of compromise by “Operation Triangulation”
If I was an intelligence agency, I would have one department whose job is to 'get caught'.   Ie. they use dumb methods to spy on obvious targets, like using exploits to install malware that leaves a wake of plenty of discoverable info and loudly sends data back to the mothership.I would then have another department whose job is to be as subtle as possible - for example, all their exploits are 'in ram' and all data sent back is plausibly deniable.  (for example, rather than using a random 256 bit nonce while establishing an HTTPS connection to apple to check for updates, use 256 bits of encrypted data you wish to exfiltrate)