Operation Triangulation

Campaign
7 incidents First seen 2026-03-03 Last seen 2026-06-03
Overview

Operation Triangulation, a cyber campaign linked to the Coruna iOS exploit kit, has been observed targeting countries including Saudi Arabia, Turkey, Malaysia, Ukraine, Canada, Russia, China, and the United States. The campaign utilizes an advanced framework that enables full-chain attacks on iPhones running iOS 18.4-18.7, with possible links to a broader threat actor campaign. In addition, multiple threat actors have leveraged Coruna exploit kits over the past year to deliver malicious payloads, including those targeting government sectors in Ukraine and Russia. The campaign has been linked to NotPetya and WannaCry malware, indicating a potential "EternalBlue moment" with echoes of the 2017 global ransomware attacks.

Threat ecosystem
Actors Malware Campaigns CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 190
Activity by month (incidents)
2026-032026-06
Sectors targeted
government · 2technology · 2cryptocurrency · 1media · 1retail · 1
Countries targeted
RU · 4CN · 3UA · 3BE · 2DE · 2ES · 2FR · 2GR · 2HU · 2IT · 2US · 2AF · 1
Origin
RU · 4CN · 3PK · 1UA · 1
Kinds of incident
Cyberattack (general) · 2Exploited Vulnerability · 1Industry & Policy · 1Malware & Botnets · 1State-Sponsored & Espionage · 1Vulnerability Disclosure · 1
Techniques seen in incidents
Espionage · 4T1588.001 - Malware · 4T1059.007 - JavaScript · 3Exfiltration · 2Ransomware · 2T1588.005 - Exploits · 2T1592.002 - Software · 2Botnet · 1Data Leak · 1Privilege Escalation · 1Reconnaissance · 1T1059.006 - Python · 1T1588.006 - Vulnerabilities · 1
Related malware
WannaCry · 2BlackCat · 1NotPetya · 1Qilin · 1
Related actors
INC Ransom · 1
Related CVEs
CVE-2023-32434 · 2CVE-2023-38606 · 2CVE-2020-27932 · 1CVE-2022-48503 · 1CVE-2023-41974 · 1CVE-2023-43000 · 1CVE-2024-23222 · 1CVE-2026-20131 · 1
Incident timeline
2026-03-29
Apple issues urgent lock screen warnings for unpatched iPhones and iPads
2026-03-27
Apple Sends Lock Screen Alerts to Outdated iPhones Over Active Web-Based Exploits
2026-03-03
Possible U.S.-developed exploits linked to first known ‘mass’ iOS attack