# Operation Triangulation: zero-click iMessage spyware on Kaspersky's iPhones · pwn.watch

> Kaspersky found a years-long zero-click iMessage campaign on its own staff's iPhones. The chain used several Apple zero-days, including a bypass of hardware memory protections through undocumented MMIO registers (CVE-2023-38606), which was revealed at 37C3 in December 2023.

Page: https://pwn.watch/i/operation-triangulation-ios-zero-click-2023 · generated 2026-10-22T20:15:47.501Z

## Status
- Severity: high · status: closed · patch: patched
- Product: Apple iOS (and other Apple OSes sharing the bugs)
- Started: 2023-06-01 · closed: 2023-12-27
- CVEs: CVE-2023-32434, CVE-2023-32435, CVE-2023-38606
- Affected: Exploited against iOS versions before iOS 15.7 / 15.7.1 (NVD)
- Fixed in: CVE-2023-32434: iOS 16.5.1, iOS 15.7.7, macOS Ventura 13.4.1, Monterey 12.6.7, Big Sur 11.7.8, watchOS 9.5.2, 8.8.1 (NVD); CVE-2023-32435: iOS 16.4, iOS 15.7.7, macOS Ventura 13.3, Safari 16.4 (NVD); CVE-2023-38606: iOS 16.6, iOS 15.7.8, macOS Ventura 13.5, Monterey 12.6.8, Big Sur 11.7.9, tvOS 16.6, watchOS 9.6 (NVD)

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/operation-triangulation-ios-zero-click-2023/feed.xml
- JSON Feed: https://pwn.watch/i/operation-triangulation-ios-zero-click-2023/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/operation-triangulation-ios-zero-click-2023.json
- This file: https://pwn.watch/i/operation-triangulation-ios-zero-click-2023/llms.txt

## Updates (newest first)
- 2023-12-27: At 37C3, Kaspersky details the hardware-feature bypass behind CVE-2023-38606 (https://securelist.com/operation-triangulation-the-last-hardware-mystery/111669/)
- 2023-07-24: Apple fixes CVE-2023-38606 (iOS 16.6); KEV entry follows on July 26 (https://nvd.nist.gov/vuln/detail/CVE-2023-38606)
- 2023-06-21: Apple fixes CVE-2023-32434 and CVE-2023-32435; CISA adds them to KEV on June 23 (https://nvd.nist.gov/vuln/detail/CVE-2023-32434)
- 2023-06-01: Kaspersky discloses Operation Triangulation (https://securelist.com/operation-triangulation/109842/)

## Fix brief
# Security brief: Operation Triangulation: zero-click iMessage spyware on Kaspersky's iPhones

Source: https://pwn.watch/i/operation-triangulation-ios-zero-click-2023 · status: closed (closed Dec 27, 2023) · severity: high · updated Dec 27, 2023

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
Kaspersky found a years-long zero-click iMessage campaign on its own staff's iPhones. The chain used several Apple zero-days, including a bypass of hardware memory protections through undocumented MMIO registers (CVE-2023-38606), which was revealed at 37C3 in December 2023.

Severity detail: Zero-click spyware chain, actively exploited (CISA KEV)

- Product: Apple iOS (and other Apple OSes sharing the bugs)
- CVE / advisory ids: CVE-2023-32434, CVE-2023-32435, CVE-2023-38606

## Affected versions
- Exploited against iOS versions before iOS 15.7 / 15.7.1 (NVD)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- CVE-2023-32434: iOS 16.5.1, iOS 15.7.7, macOS Ventura 13.4.1, Monterey 12.6.7, Big Sur 11.7.8, watchOS 9.5.2, 8.8.1 (NVD)
- CVE-2023-32435: iOS 16.4, iOS 15.7.7, macOS Ventura 13.3, Safari 16.4 (NVD)
- CVE-2023-38606: iOS 16.6, iOS 15.7.8, macOS Ventura 13.5, Monterey 12.6.8, Big Sur 11.7.9, tvOS 16.6, watchOS 9.6 (NVD)

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Latest updates
- Dec 27, 2023: At 37C3, Kaspersky details the hardware-feature bypass behind CVE-2023-38606
- Jul 24, 2023: Apple fixes CVE-2023-38606 (iOS 16.6); KEV entry follows on July 26
- Jun 21, 2023: Apple fixes CVE-2023-32434 and CVE-2023-32435; CISA adds them to KEV on June 23
- Jun 1, 2023: Kaspersky discloses Operation Triangulation

## Advisories
- [NVD: CVE-2023-32434](https://nvd.nist.gov/vuln/detail/CVE-2023-32434) (NVD)
- [NVD: CVE-2023-32435](https://nvd.nist.gov/vuln/detail/CVE-2023-32435) (NVD)
- [NVD: CVE-2023-38606](https://nvd.nist.gov/vuln/detail/CVE-2023-38606) (NVD)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) (CISA)

## Write-ups & news
- [Operation Triangulation: iOS devices targeted with previously unknown malware](https://securelist.com/operation-triangulation/109842/)
- [Operation Triangulation: The last (hardware) mystery](https://securelist.com/operation-triangulation-the-last-hardware-mystery/111669/)

## Caveats
The chain also used CVE-2023-41990 (TrueType, added to KEV in January 2024, so not listed here).

---
Machine-readable: https://pwn.watch/i/operation-triangulation-ios-zero-click-2023.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.