Operation Triangulation

Summary

iOS espionage operation Kaspersky discovered in 2023 on the iPhones of its own employees: zero-click iMessage attachments chained four zero-days — including an unknown hardware feature of Apple-designed SoCs (CVE-2023-38606) — to install the TriangleDB implant, which recorded audio, stole keychain and app data, tracked location and erased its traces. The oldest infection traces date to 2019 and activity was ongoing in June 2023. MITRE tracks it as campaign C0054 by 'unidentified actors'. Attribution: Kaspersky made none. Russia's FSB said US intelligence, with Apple's help, infected thousands of iPhones, including Russian officials' and foreign embassy staff's (claimed; Apple denied). In March 2026 Kaspersky found that the Coruna iOS exploit kit — seen in 2025 with a commercial-surveillance customer, the suspected Russian cluster UNC6353 and the Chinese criminal cluster UNC6691 — carries an updated version of Triangulation's kernel exploit, which Kaspersky assumes comes from the same exploitation framework; iVerify assesses Coruna resembles frameworks of US-government-affiliated actors. That makes the exploit framework, not the original operator, the thing that spread. MITRE maps C0054 in its Mobile matrix (for example T1404, T1429 and T1630.002); this corpus carries Enterprise IDs, so the techniques listed are their Enterprise equivalents.

Attribution

FSB blames US intelligence; Kaspersky made no attribution

Tracked by researchers; no state or organisation has been publicly attributed.

• CyberScoop (Press, 2023-06-01)
  Kaspersky declined to attribute; Apple denied any backdoor
• BleepingComputer, reporting the FSB (Claim, 2023-06-01)
  FSB blames US intelligence (adversary-government claim)

Campaigns 2

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 4

Malware and tools 2

Exploited vulnerabilities 4

Highest CVSS first.

Infrastructure patterns

• Further exploit stages and the final payload pulled from HTTPS C&C servers (Kaspersky, 2023; MITRE ATT&CK, 2026)

Reporting and advisories 6

• MITRE ATT&CK
  C0054 Operation Triangulation (campaign)
• Kaspersky GReAT
  Operation Triangulation: the last (hardware) mystery
• Kaspersky GReAT
  Coruna: an updated Operation Triangulation exploit
• Google Threat Intelligence Group
  Coruna: a powerful iOS exploit kit
• iVerify
  First known mass iOS attack (Coruna / CryptoWaters)
• Kaspersky GReAT
  Zero-click iMessage exploitation of iPhones (incl. Kaspersky staff) — TriangleDB