Loading threat actor…
Operation Triangulation is a targeted mobile espionage campaign centered on the compromise of iOS devices through a zero-click iMessage exploit chain. The operation is associated with advanced persistent threat activity and has been linked to the deployment of the TriangleDB implant. Its operators collected device and user information, including handset identifiers and serial-related metadata obtained through implant heartbeat communications, and exfiltrated SMS messages and data stored in SQLite databases. The campaign also demonstrated defense-evasion behavior by removing files from compromised devices, including cleanup of artifacts associated with the intrusion lifecycle. Known aliases include operation_triangulation and operation_triangulation_(unknown_apt_group). The activity profile is consistent with a sophisticated surveillance-focused actor conducting covert collection from mobile devices rather than financially motivated crime or ransomware.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
15 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Threat actors in Operation Triangulation stole data from SQLite databases.
Activity cluster associated with theft of data from SQLite databases.
Threat activity cluster associated here with theft of data from SQLite databases on compromised devices.
Named activity cluster/campaign involving collection of device and user information.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.