MITRE ATT&CKsoftware (malware)

S1215 Binary Validator

Published 2025-03-27 Modified 2025-04-02 Official page ↗
Domain
mobile
Platforms
iOS
Version
1.0
Created
2025-03-27

Description

Binary Validator is a Mach-O binary file used during Operation Triangulation. Binary Validator first collects information about the device, such as the device's phone number and a list of installed applications, before the deployment of the TriangleDB implant. After the actions are completed and the data is collected, Binary Validator encrypts and sends the data to the C2 server, and in turn, the C2 server sends the TriangleDB implant.

Related

Uses · MITRE ATT&CK (7)

  • T1646 Exfiltration Over C2 Channel technique
  • T1627 Execution Guardrails technique
  • T1630.002 File Deletion sub-technique
  • T1533 Data from Local System technique
  • T1418 Software Discovery technique
  • T1422 System Network Configuration Discovery technique
  • T1424 Process Discovery technique

Referenced by MITRE ATT&CK · uses (1)

  • C0054 Operation Triangulation campaign

References