Operation Triangulation — APT Profile

Operation Triangulation is the name Kaspersky gave, in a Securelist disclosure dated 1 June 2023, to a zero-click iOS espionage campaign it uncovered after spotting suspicious traffic from iPhones on its own corporate mobile Wi-Fi network. Infection required nothing from the victim: an iMessage attachment triggered a vulnerability that led to code execution, after which the initiating message and its exploit were deleted. Kaspersky dated the oldest infections it found to 2019 and said the attack was still ongoing as of June 2023, with iOS 15.7 the newest version it saw successfully targeted. The final payload, the TriangleDB implant, ran with root privileges and was deployed in memory, so a reboot erased every trace of it; it gathered system and user information and could run arbitrary code delivered as plugin modules from a command-and-control server. When Kaspersky published its full chain analysis on 27 December 2023 it accounted for four zero-days: CVE-2023-41990 in the undocumented, Apple-only ADJUST TrueType font instruction, CVE-2023-32434 (an integer overflow in XNU's memory-mapping syscalls), CVE-2023-32435 in the Safari stage, and CVE-2023-38606, the mitigation for a hardware memory-mapped I/O register path used to bypass the Page Protection Layer. Kaspersky called it the most sophisticated attack chain it had ever seen, and the operators behind it remain unidentified.

IntelFusions coverage (2)

Apple now puts spyware warnings on the Lock Screen 2026-08-14 · Nation-State
Operation Triangulation: Four Zero-Days Including Undocumented GPU CoreSight MMIO Hardware Feature Used to Bypass Apple PPL in Most Sophisticated iOS Attack Chain Ever Analyzed 2026-02-16 · Nation-State

Vendor research

Securelist Kaspersky

Read the full analysis on IntelFusions