Russian AV vendor Kaspersky has released a new automated tool designed to help iOS users easily test whether they are infected with malware delivered via specific zero-click exploits.
The news follows details of a new espionage operation Kaspersky dubbed Operation Triangulation, which it claims originated in 2019 and is still ongoing.
For more information on zero-click exploits, see New zero-click iOS exploit deploys Israeli spyware.
The campaign came after Kaspersky discovered that employee devices on its global corporate network were infected with malware that it believed was deployed via a zero-click exploit.
A user receives an iMessage with an attachment containing an exploit. This causes a code execution vulnerability even if the user has not opened the attachment. This code is programmed to download additional payloads to the device for privilege escalation etc. before deleting the original iMessage.
In its first post, Kaspersky explained how concerned users can test the threat. However, an automated tool has been released that makes this process much easier.
“This process is time-consuming and requires manual searching for several indicators. To automate this process, we have developed a dedicated utility that scans your backups and performs all the checks,” says Kaspersky. is writing “For Windows and Linux, the tool can be downloaded as a binary build, and for MacOS it can be easily installed as a Python package.”
Certain Indicators of Compromise (IoCs) will trigger a “found” result in the triangle_check utility, but if they are not present, the user will see the message “No Indicators of Compromise Identified”. I mean
However, according to the AV vendor, a “suspect” message indicates the presence of a “combination of less specific indicators” that indicate a “probability of infection.”
This kind of zero-click exploit is popularized by several commercial spyware vendors like NSO Group, who are said to be contracted by the dictatorship. However, the Russian Intelligence Service (FSB) has linked this particular campaign to US espionage without evidence.
Editorial image credit: Ralf Liebhold / Shutterstock.com
