{"id":42283,"date":"2023-06-22T20:25:43","date_gmt":"2023-06-22T17:25:43","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=42283"},"modified":"2026-03-28T03:37:44","modified_gmt":"2026-03-28T00:37:44","slug":"kaspersky-reveals-details-behind-the-spyware-used-in-operation-triangulation","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/kaspersky-reveals-details-behind-the-spyware-used-in-operation-triangulation\/","title":{"rendered":"Kaspersky reveals details behind the spyware used in Operation Triangulation"},"content":{"rendered":"\n

Following the report on the Operation Triangulation campaign targeting iOS devices, Kaspersky experts are\u00a0shedding light on the details of the spyware implant used during the attacks. Dubbed\u00a0TriangleDB, the implant grants attackers covert surveillance capabilities. It operates solely in memory, ensuring all evidence of the implant is erased upon device reboot.<\/h3>\n\n\n\n

Kaspersky recently reported on a new mobile Advanced Persistent Threat (APT) campaign that explicitly targets iOS devices via iMessage. Following the six-month investigation, the company\u2019s researchers have\u00a0published\u00a0an in-depth analysis of the exploitation chain and uncovered details of the spyware implant operation. The implant, dubbed TriangleDB, is deployed by exploiting a kernel vulnerability to acquire root privileges on the targeted iOS device. Once deployed, it operates solely in the device\u2019s memory; hence, the infection’s traces disappear upon the reboot. Consequently, if the victim restarts their device, the attacker needs to reinfect it by sending another iMessage with a malicious attachment, again initiating the entire exploitation process. If no reboot occurs, the implant will automatically uninstall itself after 30 days unless the attackers extend this period. Operating as complex spyware, TriangleDB performs a wide range of data collection and monitoring capabilities.<\/p>\n\n\n\n

In total, the implant includes 24 commands with diverse functionalities. These commands serve various purposes, such as interacting with the device\u2019s filesystem (including file creation, modification, exfiltration, and removal), managing processes (listing and termination), extracting keychain items to gather victim credentials, and monitoring the victim\u2019s geolocation, among others.<\/p>\n\n\n\n

While analyzing TriangleDB, Kaspersky experts discovered that the CRConfig class contains a new populateWithFieldsMacOSOnly method. While not utilized in the iOS implant, its presence suggests the possibility of targeting macOS devices with a similar implant.<\/p>\n\n\n\n

\u201cAs we delved into the attack, we discovered a sophisticated iOS implant that displayed numerous intriguing oddities.\u00a0We continue analyzing the campaign and will update everyone<\/em> with further insights into this sophisticated attack.\u00a0We call upon the cybersecurity community to unite, share knowledge and collaborate to get a clearer picture around the threats out there,\u201d\u00a0comments Georgy Kucherin, a security expert at Kaspersky Global Research and Analysis Team (GReAT).<\/p>\n\n\n\n

To learn more about TriangleDB spyware, visit\u00a0Securelist.com<\/a>.<\/p>\n\n\n\n

Kaspersky researchers have released a particular \u2018triangle_check\u2019 utility that automatically searches for malware infection.\u00a0For a detailed guide on how to check your device, read the\u00a0blogpost<\/a>.<\/p>\n\n\n\n

To avoid falling victim to a targeted attack by a known or unknown threat actor, Kaspersky researchers recommend implementing the following measures:<\/p>\n\n\n\n