Loading malware…
Operation Triangulation is a targeted iOS spyware campaign discovered by Kaspersky on its own network and publicly disclosed in 2023. Kaspersky reported that multiple Apple iPhones and other iOS devices across its premises worldwide had been infected since at least 2019. The malware is described as espionage-oriented and associated with a zero-click exploit chain delivered through iMessage, exploiting flaws in iMessage attachment processing to achieve code execution without user interaction, escalate privileges, download additional payloads, execute commands, and collect information from infected devices. Kaspersky linked CVE-2023-38606 to the exploit chain used to deploy the spyware on iPhones, and reporting also references Apple fixes for exploited zero-days relevant to the chain.
Kaspersky identified forensic traces associated with the campaign, including a process referring to itself as "BackupAgent" running around the time of compromise and consuming mobile data. Kaspersky released detection utilities named Triangle Check / triangle_check to analyze iOS backups for indicators of compromise, with results such as DETECTED or SUSPICION. Because of iOS security protections, the tooling analyzes backups rather than live devices. Kaspersky cautioned that negative results are not definitive because analysis is ongoing and newer variants may exist.
The campaign has been linked in reporting by the Russian FSB to infections involving high-ranking Russian government officials and foreign diplomats, but public attribution remains unresolved. Kaspersky’s published findings support the existence of a real intrusion campaign, while the exact origin, orchestrators, and full victimology remain unknown in the provided content. The campaign is consistently discussed alongside other mercenary or state-grade mobile spyware such as Pegasus, Predator, Reign, and Graphite, and ANSSI cites Triangulation as an example of a sophisticated zero-click mobile threat.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
9 distinct techniques documented for this family, organized by ATT&CK tactic.
No matter how much an attacker thinks they are varying the behavior of their infrastructure, it is likely that there will be some link between operations carried out with shared tooling in multiple contexts.
the 'Operation Triangulation' malware campaign uses an unknown zero-day exploit on iMessage to perform code execution without user interaction and elevated privileges.
Messaging apps are a royal road onto devices... this attack appears to leverage a flaw in a messaging app. Past NSO attacks have exploited flaws in iMessage attachment processing... as well as flaws in WhatsApp’s negotiation of end-to-end encryption for video calls.
This allows the attack to download further payloads to the device for further command execution and information collection.
Past NSO attacks have exploited flaws in iMessage attachment processing (as TRIANGULATION apparently did) as well as flaws in WhatsApp’s negotiation of end-to-end encryption for video calls.
the 'Operation Triangulation' malware campaign uses an unknown zero-day exploit on iMessage to perform code execution without user interaction and elevated privileges.
This allows the attack to download further payloads to the device for further command execution and information collection.
This allows the attack to download further payloads to the device for further command execution and information collection.
Kaspersky told Reuters they came to know about the attack in early 2023, when they discovered suspicious data exfiltration from devices used by Kaspersky’s management.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.