Operation Triangulation is a targeted cyberattack on iOS devices conducted using a chain of four zero-day vulnerabilities . It was first disclosed in June 2023 [ 1 ] and is notable for its unprecedented technical complexity among attacks targeting iOS. The number of victims is estimated to be in the thousands.
The goal of the attack was espionage: extracting messages and passwords from devices, recording conversations, and tracking geolocation . The exact number of victims is unknown due to the high level of stealth by the attackers. Some sources estimate several thousand victims, including commercial, governmental and diplomatic organizations in Russia and its overseas representatives. [ 2 ]
June 1, 2023: Russian cybersecurity firm Kaspersky announces the discovery of traces of a new kind of malware on the iOS devices of its employees. The malware is designed for espionage and is highly stealthy, detected only by unusual data exchange with infected iPhones . Investigators found traces of first infections dating back to 2019. The attack is named Operation Triangulation . [ 1 ]
A tool called triangle_check is released to allow users to check if their iOS devices have been compromised and determine whether they have been victims of the attack. [ 3 ] [ 4 ] [ 5 ]
On the same day, the Russian Federal Security Service (FSB) issued a statement about the discovery of malware affecting Apple mobile phones, accusing Apple of collaborating with the NSA. The statement indicated that several thousand phones were infected, including those outside Russia in NATO countries, the post-Soviet space, Israel , Syria and China . [ 6 ] [ 7 ]
June 21, 2023: Kaspersky publishes research on the TriangleDB implant used in the attack. [ 8 ] [ 9 ]