Operation Triangulation

Operation Triangulation is a sophisticated iOS spyware campaign active since at least 2019 that targeted Apple mobile devices in highly selective espionage operations. The campaign became publicly known in 2023 after anomalous activity was identified on iPhones, and it has been described as a long-running intrusion set affecting users in Russia, including diplomatic and other high-value targets. It used a spyware implant together with multiple zero-day exploits against Apple platforms, and researchers have linked exploit components associated with later tooling such as Coruna to the same exploit lineage.

A defining delivery mechanism of Operation Triangulation was the use of malicious iMessage attachments to trigger exploitation on targeted devices. The campaign relied on chained vulnerabilities in iOS and kernel-level exploitation to gain code execution and deploy its implant. Public reporting has tied CVE-2023-32434 and CVE-2023-38606 to the operation as zero-days, and subsequent analysis indicates that later exploit frameworks reused and evolved parts of the same codebase.

Operation Triangulation is best characterized as spyware focused on covert surveillance of iPhone users. It is associated with advanced post-exploitation tradecraft and a mature exploit capability consistent with a high-end threat actor or commercial spyware ecosystem. Attribution remains unresolved in open reporting: Russian authorities publicly blamed the United States, while Apple denied related allegations, and independent researchers did not conclusively attribute the campaign to a specific government or known intrusion group.

The campaign is notable for demonstrating sustained, stealthy compromise of iOS devices at scale against selected victims and for illustrating how sophisticated mobile espionage tooling can persist across multiple years and evolve into related exploit frameworks used in later operations.