MITRE ATT&CKsoftware (malware)

S1216 TriangleDB

Published 2025-03-27 Modified 2025-04-02 Official page ↗
Domain
mobile
Platforms
iOS
Version
1.0
Created
2025-03-27

Description

TriangleDB is an Objective-C written implant deployed after Binary Validator and after root privileges are obtained during Operation Triangulation’s infection chain. Upon execution, TriangleDB communicates with the C2 server, relaying information about the victim device.

Related

Uses · MITRE ATT&CK (12)

  • T1644 Out of Band Data technique
  • T1521.001 Symmetric Cryptography sub-technique
  • T1521.002 Asymmetric Cryptography sub-technique
  • T1634.001 Keychain sub-technique
  • T1630.002 File Deletion sub-technique
  • T1544 Ingress Tool Transfer technique
  • T1533 Data from Local System technique
  • T1418 Software Discovery technique
  • T1420 File and Directory Discovery technique
  • T1422 System Network Configuration Discovery technique
  • T1424 Process Discovery technique
  • T1430 Location Tracking technique

Referenced by MITRE ATT&CK · uses (1)

  • C0054 Operation Triangulation campaign

References