MITRE ATT&CKcampaign

C0054 Operation Triangulation

Published 2025-03-28 Modified 2026-07-31 Official page ↗
Domain
mobile
Version
1.0
Created
2025-03-28

Description

Operation Triangulation is a mobile campaign targeting iOS devices. The unidentified actors used zero-click exploits in iMessage attachments to gain Initial Access, then executed exploits and validators, such as Binary Validator before finally executing the TriangleDB implant.

Related

Uses · MITRE ATT&CK (22)

  • S1215 Binary Validator software (malware)
  • S1216 TriangleDB software (malware)
  • T1658 Exploitation for Client Execution technique
  • T1521.001 Symmetric Cryptography sub-technique
  • T1521.002 Asymmetric Cryptography sub-technique
  • T1634.001 Keychain sub-technique
  • T1636.004 SMS Messages sub-technique
  • T1630 Indicator Removal on Host technique
  • T1630.002 File Deletion sub-technique
  • T1575 Native API technique
  • T1544 Ingress Tool Transfer technique
  • T1533 Data from Local System technique
  • T1404 Exploitation for Privilege Escalation technique
  • T1409 Stored Application Data technique
  • T1418 Software Discovery technique
  • T1420 File and Directory Discovery technique
  • T1422 System Network Configuration Discovery technique
  • T1424 Process Discovery technique
  • T1426 System Information Discovery technique
  • T1429 Audio Capture technique
  • T1430 Location Tracking technique
  • T1437 Application Layer Protocol technique

References