TriangleDB

TriangleDB is a sophisticated malware implant targeting iOS devices, discovered as part of a likely state-sponsored cyber-espionage campaign named Operation Triangulation. The malware was first disclosed by Kaspersky researchers in June, revealing its deployment through a new zero-click iOS attack. TriangleDB's infection chain contains two unique stages known as "JavaScript Validator" and "Binary Validator," which are launched prior to the implant's deployment. This implant is associated with a series of Apple zero-day flaws (CVE-2023-46690, CVE-2023-32434, CVE-2023-32439), affecting both iPhones and iPads across government and corporate targets. During their investigation, Kaspersky researchers unearthed numerous curious details about TriangleDB. For instance, while it already possesses multiple oddities, there are also disabled features within the implant that could potentially be deployed in the future. These findings were part of a six-month-long investigation, during which Kaspersky successfully collected all components of the attack chain and completed an extensive analysis of the spyware implant. In response to the discovery and disclosure of TriangleDB, Apple patched the kernel bug exploited by the malware in June. This action effectively neutralized the threat posed by TriangleDB, protecting iOS users from potential exploitation and data theft. Despite this, the existence and sophistication of TriangleDB underscore the ongoing threats faced by digital devices and the importance of robust cybersecurity measures.