2 more Apple zero-days exploited in ongoing iOS spy campaign

Apple has released emergency patches for two new zero-day vulnerabilities in its software that an advanced persistent threat (APT) actor has been using to deploy malware in an ongoing iOS spying campaign dubbed “Operation Triangulation.”

Meanwhile on Wednesday, Kaspersky released a new report that provided additional details on the TriangleDB spyware implant used in the campaign, which it flagged as containing a number of oddities, such as disabled features that could be deployed at a future time.

According to the company, its analysis showed that for now, the malware supports 24 functional commands that serve various purposes such as creating, modifying, removing and stealing files, listing and terminating processes, gathering credentials from the victim’s keychain and monitoring their location.

“Features that we found especially significant are the abilities to read any file on the infected device, extract passwords from the victim’s keychain and track the device geolocation,” says Georgy Kucherin, one of the security researchers at Kaspersky who discovered the zero-day bugs that Apple disclosed this week.

A Trio of Zero-Days

One of the newly addressed security vulnerabilities (CVE-2023-32434) affects multiple iOS versions and gives attackers a way to execute arbitrary code with kernel level privileges on iPhones and iPads. The other vulnerability (CVE-2023-32439) exists in Apple’s WebKit browser and enables arbitrary code execution via maliciously crafted web content. Apple on June 21, 2023, issued updates addressing both vulnerabilities.

The two bugs are part of a set of three Apple zero-days that researchers at Kaspersky have discovered so far while investigating Operation Triangulation. The investigation began about seven months ago when the security firm spotted several dozen iOS devices on its corporate Wi-Fi network behaving in a suspicious manner.

The company released a report on its initial analysis of the malicious activity, in early June. At the time, Kaspersky described the attackers as likely exploiting multiple vulnerabilities in Apple software to deliver the TriangleDB spyware implant on iOS devices belonging to targeted iOS users. Researchers at the company identified the first of the flaws as CVE-2022-46690, an out-of-bounds issue that allowed an application to execute arbitrary code at the kernel level. Kaspersky described the malware itself as running with root privileges, capable of executing arbitrary code on affected devices and implementing a set of commands for collecting system and user information.

To read the complete article, visit Dark Reading.