LiveActive security incident?Get immediate response
MITRE ATT&CK® Campaign

C0054: Operation Triangulation

Operation Triangulation is a mobile campaign targeting iOS devices.[1] The unidentified actors used zero-click exploits in iMessage attachments to gain Initial Access, then executed exploits and validators, such as Binary Validator before finally executing the TriangleDB implant.

MobileC0054CampaignObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

C0054: Operation Triangulation describes [Operation Triangulation](https://attack.mitre.org/campaigns/C0054) is a mobile campaign targeting iOS devices.(Citation: SecureList OpTriangulation 01Jun2023) The unidentified actors used zero-click exploits in iMessage attachments to gain [Initial Access](https://attack.mitre.org/tactics/TA0027), then executed exploits and validators, such as [Binary Validator](https://attack.mitre.org/software/S1215) before finally executing the [TriangleDB](https://attack.mitre.org/software/S1216) implant.

Executive priority

C0054: Operation Triangulation is an official MITRE ATT&CK campaign. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate C0054: Operation Triangulation by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

  • Official ATT&CK relationships and object metadata

Detection direction

  • Validate whether C0054: Operation Triangulation appears in your detection coverage and tabletop scenarios.
  • Use the object to align executive risk language with SOC, incident response, and detection engineering work.
  • Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

  • Map the object to existing controls and identify missing telemetry or response ownership.
  • Prioritize mitigations that reduce exposure on the listed platforms and tactics.
  • Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Operation Triangulation

Operation Triangulation is a mobile campaign targeting iOS devices.[1] The unidentified actors used zero-click exploits in iMessage attachments to gain Initial Access, then executed exploits and validators, such as Binary Validator before finally executing the TriangleDB implant.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

20 rows
DomainIDNameRelationship / procedure
MobileT1418Software Discovery

During Operation Triangulation, the threat actors have obtained a list of installed applications.CitationSecureList OpTriangulation 21Jun2023

MobileT1404Exploitation for Privilege Escalation

During Operation Triangulation, the threat actors exploited a kernel vulnerability to obtain root privileges.CitationSecureList OpTriangulation 21Jun2023

MobileT1533Data from Local System

During Operation Triangulation, the threat actors stole data from SQLite databases.CitationSecureList OpTriangulation 23Oct2023

MobileT1630.002File DeletionSub-technique

During Operation Triangulation, the threat actors removed files from the device.CitationSecureList OpTriangulation 21Jun2023

MobileT1544Ingress Tool Transfer

During Operation Triangulation, the threat actors downloaded subsequent stages from the C2.[1]CitationSecureList OpTriangulation 21Jun2023

MobileT1521.001Symmetric CryptographySub-technique

During Operation Triangulation, the threat actors used 3DES and AES to encrypt C2 communication and data.CitationSecureList OpTriangulation 21Jun2023CitationSecureList OpTriangulation 23Oct2023

MobileT1430Location Tracking

During Operation Triangulation, the threat actors monitored the device’s geolocation.CitationSecureList OpTriangulation 21Jun2023CitationSecureList OpTriangulation 23Oct2023

MobileT1422System Network Configuration Discovery

During Operation Triangulation, the threat actors use the heartbeat beacons from the implant to obtain device information, such as the IMEI, MEID, and the serial number.CitationSecureList OpTriangulation 21Jun2023

MobileT1630Indicator Removal on Host

During Operation Triangulation, the threat actors deleted the initial exploitation message and exploit attachment.[1]

MobileT1424Process Discovery

During Operation Triangulation, the threat actors have obtained a list of processes.CitationSecureList OpTriangulation 21Jun2023

MobileT1420File and Directory Discovery

During Operation Triangulation, the threat actors have obtained a list of files in a specified directory using the `fts` API.CitationSecureList OpTriangulation 21Jun2023

MobileT1634.001KeychainSub-technique

During Operation Triangulation, the threat actors have dumped the device’s keychain.CitationSecureList OpTriangulation 21Jun2023CitationSecureList OpTriangulation 23Oct2023

MobileT1658Exploitation for Client Execution

During Operation Triangulation, the threat actors sent iMessage messages with malicious exploits that executed without user interaction.[1]CitationSecureList OpTriangulation 23Oct2023CitationSecureList OpTriangulation Dec2023 Additionally, the threat actors have used various exploits, such as CVE-2023-41990, CVE-2023-32435, CVE-2023-32434 and CVE-2023-38606, to obtain privilege escalation.CitationSecureList OpTriangulation Dec2023

MobileT1437Application Layer Protocol

During Operation Triangulation, the threat actors used HTTPS POST requests for C2 communication.CitationSecureList OpTriangulation 21Jun2023

MobileT1636.004SMS MessagesSub-technique

During Operation Triangulation, the threat actors have collected and exfiltrated SMS messages.CitationSecureList OpTriangulation 23Oct2023

MobileT1429Audio Capture

During Operation Triangulation, the threat actors used a microphone-recording module.CitationSecureList OpTriangulation 23Oct2023

MobileT1521.002Asymmetric CryptographySub-technique

During Operation Triangulation, the threat actors used RSA to encrypt C2 communication.CitationSecureList OpTriangulation 21Jun2023

MobileT1575Native API

During Operation Triangulation, the threat actors use the Audio Queue API to record audio.CitationSecureList OpTriangulation 23Oct2023CitationSecureList OpTriangulation Dec2023

MobileT1409Stored Application Data

During Operation Triangulation, the threat actors have collected and exfiltrated data from WhatsApp and Telegram.CitationSecureList OpTriangulation 23Oct2023

MobileT1426System Information Discovery

During Operation Triangulation, the threat actors collected device and user information.[1]

Associated objects

Groups, software, and campaigns

MalwareMobile

S1215: Binary Validator

Binary Validator is a Mach-O binary file used during Operation Triangulation.[1] Binary Validator first collects information about the device, such as the device's phone number and a list of installed applications, before the deployment of the TriangleDB implant. After the actions are completed and the data is collected, Binary Validator encrypts and sends the data to the C2 server, and in turn, the C2 server sends the TriangleDB implant.

iOS
Relationship explorer

All related ATT&CK context

uses · TechniqueT1418: Software DiscoveryMobileuses · TechniqueT1404: Exploitation for Privilege EscalationMobileuses · TechniqueT1533: Data from Local SystemMobileuses · TechniqueT1630.002: File DeletionMobileuses · TechniqueT1544: Ingress Tool TransferMobileuses · TechniqueT1521.001: Symmetric CryptographyMobileuses · TechniqueT1430: Location TrackingMobileuses · TechniqueT1422: System Network Configuration DiscoveryMobileuses · TechniqueT1630: Indicator Removal on HostMobileuses · TechniqueT1424: Process DiscoveryMobileuses · TechniqueT1420: File and Directory DiscoveryMobileuses · TechniqueT1634.001: KeychainMobileuses · TechniqueT1658: Exploitation for Client ExecutionMobileuses · TechniqueT1437: Application Layer ProtocolMobileuses · TechniqueT1636.004: SMS MessagesMobileuses · TechniqueT1429: Audio CaptureMobileuses · TechniqueT1521.002: Asymmetric CryptographyMobileuses · TechniqueT1575: Native APIMobileuses · TechniqueT1409: Stored Application DataMobileuses · MalwareS1215: Binary ValidatorMobileuses · TechniqueT1426: System Information DiscoveryMobileuses · MalwareS1216: TriangleDBMobile
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
20.0
Object version
1.0
Created
Modified
Raw hash
e21f344262b2b5ef...
Imported snapshots across ATT&CK releases(3)
ReleaseBundle importedObject versionModifiedStatusRaw hash
20.01.0Current bundlee21f344262b2…
19.21.0Older bundlee21f344262b2…
19.11.0Older bundle154ec4335288…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    SecureList OpTriangulation 01Jun2023

    Kuznetsov, I., et al. (2023, June 1). Operation Triangulation: iOS devices targeted with previously unknown malware. Retrieved April 18, 2024.

    Open source URL
  2. [2]
    mitre-attackC0054
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use