The Triangulation Trojan, also called Operation Triangulation, is a targeted spyware attack on Apple devices. It reaches iPhones through an invisible iMessage with a malicious attachment that runs without user action, It was found by Kaspersky on its own corporate network in 2023.
How Does the Triangulation Trojan Attack Apple Devices?
Kaspersky uncovered an advanced, targeted cyberattack on Apple’s mobile devices on its own corporate network. The attack, named “Triangulation,” plants covert spyware on iPhones.
The cyberattack employs an invisible iMessage carrying a malicious attachment. The attachment exploits a vulnerability in iOS and runs code on the device without any user action. The final payload runs with root privileges, collects system and user information and can run further code downloaded from a remote server.
- Invisible iMessageCarries a malicious attachment.
- Attachment executesAn iOS vulnerability runs it with no user action.
- Spyware installedPlaced on the device without the user noticing.
- Data sent outSystem and user information goes to remote servers, and more code can be downloaded.
The closed nature of iOS makes this spyware hard to detect and needs external tools. Kaspersky’s own write-up describes making an offline backup of the device and checking it with the free Mobile Verification Toolkit.
Keeping iOS up to date matters. Apple has fixed an actively exploited iOS kernel flaw, CVE-2023-32434, in iOS 15.7.7 and iOS 16.5.1 (NVD), and CISA added it to its Known Exploited Vulnerabilities catalog on 23 June 2023 (CISA).
The attack stayed hidden until Kaspersky’s own monitoring platform flagged suspicious activity on its corporate Wi-Fi network.
Kaspersky published its technical findings on Securelist, including the list of command and control domains below.
- Confirmation
- An offline device backup checked with the Mobile Verification Toolkit.
- Prevention
- Keep iOS updated, since Apple has fixed an exploited iOS kernel flaw (CVE-2023-32434).
Which C2 Domains Does the Triangulation Trojan Use?
The list comes from Kaspersky’s own report on its incident: Securelist.
addatamarket[.]net
backuprabbit[.]com
businessvideonews[.]com
cloudsponcer[.]com
datamarketplace[.]net
mobilegamerstats[.]com
snoweeanalytics[.]com
tagclick-cdn[.]com
topographyupdates[.]com
unlimitedteacup[.]com
virtuallaughing[.]com
web-trackers[.]com
growthtransport[.]net
anstv[.]net
ans7tv[.]net
It Is Not First Spyware For iMessage: Pegasus Spyware
Citizen Lab researchers documented zero-click iMessage exploits used to install Pegasus spyware on the iPhones of Catalan politicians, journalists, and activists (Citizen Lab: CatalanGate).
Pegasus is developed by the Israeli firm NSO and marketed to governments as licensed software for investigating terrorist activities.
Citizen Lab found that at least 65 people were targeted or infected with spyware, 63 of them with Pegasus, almost all between 2017 and 2020. It identified two zero-click iMessage exploits, called HOMAGE and KISMET. Targets included four Catalan members of the European Parliament, as well as politicians, journalists and activists… [Read More]
How Can Brandefense Help You?
Our innovative service offers a range of benefits that can help you stay ahead of cybercriminals and protect your brand reputation. With early detection of cyber threats, you’ll have more time to respond and prevent potential data breaches or other attacks. Our dark web monitoring can enhance your overall security posture and protect your sensitive data and assets.
Brandefense Dark Web Monitoring Solution
Early Detection of Cyber Threats: Dark web monitoring allows businesses to detect cyber threats early on, giving them more time to respond and prevent potential data breaches or other attacks.
Enhanced Security: By monitoring the dark web for potential threats, businesses can stay ahead of cybercriminals and protect their sensitive data and assets.
Brand Protection: Dark web monitoring can also help businesses protect their brand reputation by detecting any attempts to sell counterfeit products or impersonate their brand.
Cost-Effective: The cost of a data breach can be substantial in terms of financial losses and damage to brand reputation. Dark web monitoring is a cost-effective way to mitigate these risks and prevent costly cyber attacks.
Contact us today to learn more about how Brandefense’s dark web monitoring service can help you protect your business and achieve peace of mind.
Dark Web Monitoring We know what hackers know about you Discover the Solution