S1216 TriangleDB

malwareMobile

platformsiOS

also known asTriangleDB

TriangleDB is an Objective-C written implant deployed after Binary Validator and after root privileges are obtained during Operation Triangulation’s infection chain. Upon execution, TriangleDB communicates with the C2 server, relaying information about the victim device.

techniques used (12)

ATT&CK techniques this enables or maps to.

T1418Software Discovery
T1420File and Directory Discovery
T1422System Network Configuration Discovery
T1424Process Discovery
T1430Location Tracking
T1521.001Symmetric Cryptography
T1521.002Asymmetric Cryptography
T1533Data from Local System
T1544Ingress Tool Transfer
T1630.002File Deletion
T1634.001Keychain
T1644Out of Band Data

used by campaigns (1)

Campaigns that use this.

C0054Operation Triangulation

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan