The TriangleDB implant used to target Apple iOS devices packs in at least four different modules to record microphone, extract iCloud Keychain, steal data from SQLite databases used by various apps, and estimate the victim's location.
The new findings come from Kaspersky, which detailed the great lengths the adversary behind the campaign, dubbed Operation Triangulation, went to conceal and cover up its tracks while clandestinely hoovering sensitive information from the compromised devices.
The sophisticated attack first came to light in June 2023, when it emerged that iOS devices had been targeted by a zero-click exploit weaponizing then zero-day security flaws (CVE-2023-32434 and CVE-2023-32435) that leverages the iMessage platform to deliver a malicious attachment that can gain complete control over the devices and user data.
The scale and the identity of the threat actor is presently unknown, although Kaspersky itself became one of the targets at the start of the year, prompting it to investigate the various components of what it said is a fully-featured advanced persistent threat (APT) platform.
The core of the attack framework constitutes a backdoor called TriangleDB that's deployed after the attackers obtain root privileges on the target iOS device by exploiting CVE-2023-32434, a kernel vulnerability that could be abused to execute arbitrary code.
Now, according to the Russian cybersecurity company, the deployment of the implant is preceded by two validator stages, namely JavaScript Validator and Binary Validator, that are executed to determine if the target device is not associated with a research environment.
"These validators collect various information about the victim device and send it to the C2 server," Kaspersky researchers Georgy Kucherin, Leonid Bezvershenko, and Valentin Pashkov said in a technical report published Monday.
"This information is then used to assess if the iPhone or iPad to be implanted with TriangleDB could be a research device. By performing such checks, attackers can make sure that their zero-day exploits and the implant do not get burned."
By way of background: The starting point of the attack chain is an invisible iMessage attachment that a victim receives, which triggers a zero-click exploit chain designed to stealthily open a unique URL containing obfuscated JavaScript code of the NaCl cryptography library as well as an encrypted payload.
The payload is the JavaScript Validator that, besides conducting various arithmetic operations and checking for the presence of Media Source API and WebAssembly, performs a browser fingerprinting technique called canvas fingerprinting by drawing a yellow triangle on a pink background with WebGL and calculating its checksum.
The information collected following this step is transmitted to a remote server in order to receive, in return, an unknown next-stage malware. Also delivered after a successful exploitation of the WebKit and kernel exploits is a Binary Validator, a Mach-O binary file that carries out the below operations -
- Remove crash logs from the /private/var/mobile/Library/Logs/CrashReporter directory to erase traces of possible exploitation
- Delete evidence of the malicious iMessage attachment sent from 36 different attacker-controlled Gmail, Outlook, and Yahoo email addresses
- Obtain a list of processes running on the device and the network interfaces
- Check if the target device is jailbroken
- Turn on personalized ad tracking
- Gather information about the device (username, phone number, IMEI, and Apple ID), and
- Retrieve a list of installed apps
"What is interesting about these actions is that the validator implements them both for iOS and macOS systems," the researchers said, adding the results of the aforementioned actions are encrypted and exfiltrated to a command-and-control (C2) server to fetch the TriangleDB implant.
One of the very first steps taken by the backdoor is to establish communication with the C2 server and send a heartbeat, subsequently receiving commands that delete crash log and database files to cover up the forensic trail and hamper analysis.
Also issued to the implant are instructions to periodically exfiltrate files from the /private/var/tmp directory that contain location, iCloud Keychain, SQL-related, and microphone-recorded data.
A notable feature of the microphone-recording module is its ability to suspend recording when the device screen is turned on and if the battery is less than 10% charged, indicating the threat actor's intention to fly under the radar.
What's more, the location-monitoring module is orchestrated to use GSM data, such as mobile country code (MCC), mobile network code (MNC), and location area code (LAC), to triangulate the victim's location when GPS data is not available.
"The adversary behind Triangulation took great care to avoid detection," the researchers said. "The attackers also showed a great understanding of iOS internals, as they used private undocumented APIs in the course of the attack."
Update:
On October 25, 2023, Apple extended patches for the kernel security flaw to older devices as part of iOS 15.8 and iPadOS 15.8 updates, noting that the issue may have been actively exploited against versions of iOS released before iOS 15.7.
(The story was updated after publication on October 27, 2023, to include new information published by Kaspersky on the campaign and Apple's release of fixes for older devices.)
