After its continued research of Operation Triangulation, cybersecurity solutions company Kaspersky found that the APT (Advanced Persistent Threat) campaign has the capability to monitor and collect data from iOS devices.

According to Kaspersky, the APT campaign operates solely in memory, ensuring that all evidence of the implant is erased upon device reboot.

The implant, dubbed TriangleDB, is deployed by exploiting a kernel vulnerability to acquire root privileges on the targeted iOS device. Once deployed, it operates solely in the device’s memory, and traces of the infection disappear upon the device reboot. If the victims restart their device, the attacker needs to reinfect it by sending another iMessage with a malicious attachment, initiating the entire exploitation process once again. If no reboot occurs, the implant will automatically uninstall itself after 30 days, unless the attackers extend this period.

Kaspersky: Ransomware is most popular Malware-as-a-Service
Kaspersky: Malware downloader installs crypto-stealing browser extension

In total, the implant includes 24 commands with diverse functionalities. These commands serve various purposes, such as interacting with the device’s filesystem (including file creation, modification, exfiltration, and removal), managing processes (listing and termination), extracting keychain items to gather victim credentials, and monitoring the victim’s geolocation, among others.

Attack methods

While analyzing TriangleDB, Kaspersky experts discovered that the CRConfig class contains an unused method called populateWithFieldsMacOSOnly. While not utilized in the iOS implant, its presence suggests the possibility of targeting macOS devices with a similar implant.

Kaspersky researchers have released a special “triangle_check” utility that automatically searches for malware infection. 

In order to avoid falling victim to a targeted attack by a known or unknown threat actor, Kaspersky researchers recommend implementing the following measures:

• For endpoint-level detection, investigation, and timely remediation of incidents, use a reliable security solution for businesses, like Kaspersky Unified Monitoring and Analysis Platform (KUMA)
• Update Microsoft Windows OS and other third-party software as soon as possible and do so regularly
• Provide your SOC team with access to the latest threat intelligence (TI). Kaspersky Threat Intelligence is a single point of access for the company’s TI, providing it with cyberattack data and insights gathered by Kaspersky spanning over 20 years.
• Upskill your cybersecurity team to tackle the latest targeted threats with Kaspersky online training developed by GReAT experts
• As many targeted attacks start with phishing or other social engineering techniques, introduce security awareness training and teach practical skills to your team.