← Actors

Operation Triangulation

Intel Library

Operation Triangulation

Threat actor1 report from 1 vendor· last reported 2026-03-26

Operation Triangulation is an ongoing APT campaign targeting iOS devices with zero-click iMessage exploits. The threat actor behind the campaign has been active since at least 2019 and continues to operate. The attack chain involves the delivery of a malicious iMessage attachment that launches a series of exploits, ultimately leading to the deployment of the TriangleDB implant. Kaspersky researchers have discovered and reported multiple vulnerabilities used in the campaign, with patches released by Apple.

Vendor aliases (1)

The same group is tracked under different names by different vendors.

VendorName
VariousOperation Triangulation

MITRE ATT&CK techniques (1)

Indicators of compromise

No IOCs extracted yet from reports naming this actor.

Report timeline

Every report in the Global Intel Library that names Operation Triangulation, newest first. Open any report to see the full analysis with provenance.

  1. Kaspersky2026-03-26
    Coruna: the framework used in Operation Triangulation
    T1055
    original

Threat feed IOCs (0)

Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to Operation Triangulation. Each row shows why it was linked and where it came from.

No feed indicators linked to this actor yet. Feeds are checked every hour.

Public research & publications (4)

Open-source reports about this actor collected from MISP Galaxy.