Ankura CTIX FLASH Update - June 2, 2023

Malware Activity

Operation Triangulation Targets iOS Devices with Zero-Click Exploit in iMessage Service

Researchers have published a new report on a campaign dubbed Operation Triangulation that began in 2019 and involves a previously unknown advanced persistent threat (APT) group. This campaign is targeting iOS devices by utilizing zero-click exploits, which is when "the receipt of the message triggers the vulnerability without requiring user interaction in order to achieve code execution." iOS devices have been observed receiving a message through iMessage that contains an exploit-embedded attachment. The exploit is configured to gain additional payloads in order to conduct the privilege escalation and drop the final-stage malware. The malware is received from a command-and-control (C2) server that researchers note is a "fully-featured APT platform." The malware has the ability to harvest sensitive data, such as microphone recordings, geolocation, photos from