GINC Technology
GINC-APT-0324 · State

Operation Triangulation

Category
State · Attributed to a state or working for one.
Origin
Unknowncontested
Motivation
Information theft and espionage
Seen
2023
Status
Dormant
Sources
6 sources carry it
Identifier
GINC-APT-0324 · operation-triangulation

What it is

Operation Triangulation is an ongoing APT campaign targeting iOS devices with zero-click iMessage exploits. The threat actor behind the campaign has been active since at least 2019 and continues to operate. The attack chain involves the delivery of a malicious iMessage attachment that launches a series of exploits, ultimately leading to the deployment of the TriangleDB implant. Kaspersky researchers have discovered and reported multiple vulnerabilities used in the campaign, with patches released by Apple.

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Chinese and Russian sources

  • Russian Federal Security Service (FSB) · 2023-06iOS zero-click campaign against Russian diplomats and Kaspersky staff. Threat actor behind it has no agreed name; Malpedia files it under Equation Group's operations.United States · FSB statement; Kaspersky, which found the campaign, made no attribution; Apple denied cooperation
  • Russian Federal Security Service (FSB) · 2026-01FSB said foreign spy agencies infected Russian officials' phones; TechCrunch later reported a US military contractor likely built iPhone tooling found in use.Western intelligence services (unnamed) · FSB statement

Tools

The tools and malware families the sources tie to it.

  • Archelaus Beta
  • TriangleDB
  • Xploit

Sources