Kaspersky unveils methods behind Operation Triangulation campaign

Following the report on the Operation Triangulation campaign targeting iOS devices, Kaspersky experts are shedding light into the details about the spyware implant used during the attacks.

Dubbed TriangleDB, the implant grants attackers covert surveillance capabilities. It operates solely in memory, ensuring that all evidence of the implant is erased upon device reboot, the security experts state.

Kaspersky recently reported on a new mobile Advanced Persistent Threat (APT) campaign that specifically targets iOS devices via iMessage. Following the six-month investigation, the company's researchers have published an in-depth analysis of the exploitation chain and uncovered details of the spyware implant operation.

The implant, dubbed TriangleDB, is deployed by exploiting a kernel vulnerability to acquire root privileges on the targeted iOS device. Once deployed, it operates solely in the devices memory, hence traces of the infection disappear upon the device reboot.

Consequently, if the victim restarts their device, the attacker needs to reinfect it by sending another iMessage with a malicious attachment, initiating the entire exploitation process once again. If no reboot occurs, the implant will automatically uninstall itself after 30 days, unless the attackers extend this period. Operating as complex spyware, TriangleDB performs a wide range of data collection and monitoring capabilities.

In total, the implant includes 24 commands with diverse functionalities, Kaspersky finds. These commands serve various purposes, such as interacting with the devices filesystem (including file creation, modification, exfiltration, and removal), managing processes (listing and termination), extracting keychain items to gather victim credentials, and monitoring the victims geolocation, among others.

While analysing TriangleDB, Kaspersky experts discovered that the CRConfig class contains an unused method called populateWithFieldsMacOSOnly. While not utilised in the iOS implant, its presence suggests the possibility of targeting macOS devices with a similar implant.

Georgy Kucherin, Security Expert at Kaspersky Global Research and Analysis Team (GReAT), says, "As we delved into the attack, we discovered a sophisticated iOS implant that displayed numerous intriguing oddities.

"We continue analysing the campaign and will keep everyone updated with further insights into this sophisticated attack. We call upon the cybersecurity community to unite, share knowledge and collaborate to get a clearer picture around the threats out there."

In order to avoid falling victim to a targeted attack by a known or unknown threat actor, Kaspersky researchers recommend implementing the following measures:

• For endpoint level detection, investigation, and timely remediation of incidents, use a reliable security solution for businesses.
• Update Microsoft Windows OS and other third-party software as soon as possible and do so regularly.
• Provide your SOC team with access to the latest threat intelligence (TI).
• Upskill your cybersecurity team to tackle the latest targeted threats with online training.
• As many targeted attacks start with phishing or other social engineering techniques, introduce security awareness training and teach practical skills to your team.