Apple patches zero day linked to spyware campaign

Apple zero day: A close up of the iPhone 14 Pro's camera system
(Image credit: Future)

Apple has released a patch for a number of vulnerabilities including an actively-exploited zero-day vulnerability linked to an ongoing spyware campaign.

The zero-day flaw, tracked as CVE-2023-38606, made it possible for an app to alter the state of a device’s kernel which could allow an attacker to leverage root-level control over a compromised device.

It was reported by researchers at Kaspersky Lab as part of an ongoing effort to uncover a sophisticated attack chain used as a vector in a spyware operation dubbed ‘Operation Triangulation’.

Researchers first reported the spyware in June, after uncovering evidence to suggest that an advanced persistent threat (APT) campaign had been working against Kaspersky staff since 2019.

At the time, it was noted that the spyware arrives through a malicious iMessage. This subsequently activates a payload using a zero-click method, so goes entirely unnoticed by victims.

Apple’s update also introduced fixes to a WebKit remote code execution flaw (CVE-2023-38594), a libxpc vulnerability that could allow an app to obtain root privileges (CVE-2023-38565), and an Apple Neural Engine flaw linked to arbitrary code execution (CVE-2023-38136).

In all, updates were released for:

  • Safari 16.6 (macOS Big Sur and macOS Monterey)
  • iOS 16.6, iPadOS 16.6 (iPhone 8 and later, all iPad Pro models, iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later)
  • iOS 15.7.8 and iPadOS 15.7.8 (all models of iPhone 6s and iPhone 7, 1st generation iPhone SE, iPad Air 2, 4th generation iPad mini, and 7th generation iPod touch
  • macOS Ventura 13.5
  • macOS Monterey 12.6.8
  • macOS Big Sur 11.7.9
  • tvOS 16.6 (All models of Apple TV 4K and Apple TV HD)
  • watchOS 9.6 (Apple Watch Series 4 and later)

In the weeks since Operation Triangulation was made public, researchers have performed more detailed analyses on the vector and exfiltration implant used by the spyware’s operators. 

The threat actors exploit the zero day (CVE-2023-38606) to gain root privileges on a victim’s iOS device, and then deploy the implant, which Kaspersky dubbed ‘TriangleDB’.

This works to alter or delete files, exfiltrate key files such as certificates or keys, and send precise geolocation data back to the operators. 

Removing the spyware via a factory reset of the phone removes all evidence of the attack, and as it operates in a device’s memory it has proved difficult to track. 


Top ten ways to eliminate cyber threats: eBook cover with green title over image of man using a laptop wearing a lanyard

(Image credit: ServiceNow)

Top ten ways to anticipate, eliminate, and defeat cyber threats like a boss

Learn how to improve your cyber resilience and vulnerability management.


By default, TriangleDB deletes itself after 30 days, though attackers can extend or shorten this period through commands send from their command-and-control (C2) infrastructure.

Researchers also found that TriangleDB’s configuration class contains a method titled ‘populateWithFieldsMacOSOnly’, leading them to warn that future such spyware attacks could occur against macOS devices.

“An app may be able to modify sensitive kernel state. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1,” Apple wrote.

The firm stated that the issue has been resolved using an improved state management method, but did not go into further detail on what this entails.

Rory Bathgate
Features and Multimedia Editor

Rory Bathgate is Features and Multimedia Editor at ITPro, overseeing all in-depth content and case studies. He can also be found co-hosting the ITPro Podcast with Jane McCallion, swapping a keyboard for a microphone to discuss the latest learnings with thought leaders from across the tech sector.

In his free time, Rory enjoys photography, video editing, and good science fiction. After graduating from the University of Kent with a BA in English and American Literature, Rory undertook an MA in Eighteenth-Century Studies at King’s College London. He joined ITPro in 2022 as a graduate, following four years in student journalism. You can contact Rory at or on LinkedIn.