Unit 1: How phones are built to defend · Lesson 5 of 5 · 26 min
Case file: iPhones talking to a stranger
Modelled on Operation Triangulation: spot iPhones beaconing from the office Wi-Fi and act before anyone forensics them.
case file
Operation Triangulation iOS zero-click campaign
Kaspersky (target) and others · 2023
Kaspersky noticed suspicious traffic from employee iPhones on its corporate Wi-Fi and, using offline backups and the Mobile Verification Toolkit, found a zero-click iMessage attack chain with traces back to 2019. The chain used four zero-days (CVE-2023-32434, CVE-2023-32435, CVE-2023-38606, CVE-2023-41990), including a bypass of hardware memory protections, and Apple patched them in 2023. The implant ran in memory and did not survive a reboot.
What went wrong
Chained zero-day vulnerabilities reachable through an iMessage attachment with no user interaction.
What would have stopped it
- Apply iOS updates quickly and enforce minimum versions through MDM
- Enable Lockdown Mode for high-risk staff; Kaspersky commented it likely helps against this chain
- Reboot devices regularly, since the implant was not persistent
What defenders could have seen
- Network monitoring of mobile Wi-Fi traffic for connections to unknown C2 domains after iMessage traffic
- MVT analysis of backups: data usage by a 'BackupAgent' process and modified empty folders in Library/SMS/Attachments
- Repeated failed iOS updates
mission
- You are
- You are the IT analyst at Kestrel Field Services.
- Situation
- Modelled on the Kaspersky case: the office firewall flagged an uncategorised domain that only staff iPhones contact. Nobody has noticed anything wrong on their phones.
- Goal
- Find which phones contact the domain, when, and what happened just before.
- Hand in
- A short note to the IT lead with the affected phones and the containment steps.
A zero-click attack as a letterbox
Search for the domain
In Office DNS, search statsync-cdn.example.
you should see Six queries over three days, from only two phones.
Look at what came just before
Search iphone-priya 2026-03-03T10:1 to see the minutes around the first contact.
you should see A query to init.ess.apple.com, an Apple identity service used by iMessage and FaceTime, seconds before the first contact.
defender tip In the real case, Kaspersky saw the same pattern: messaging traffic, then connections to unknown servers. The network was where it showed, not the phones.
Measure what left
Switch to Web proxy and search statsync.
you should see Each connection sends hundreds of kilobytes out and receives only a few. Uploads, not page loads.
Contain without destroying evidence
Block the domain at DNS and the proxy, ask both owners to keep the phones powered on and off Wi-Fi, and call for specialist help before anyone resets them.
you should see A plan that stops the leak and keeps evidence for experts.
Close the door for everyone
Update every iPhone, turn on Lockdown Mode for high-risk staff, and keep reboots regular. The Triangulation implant did not survive a restart.
you should see The same three controls show up in every zero-click case in this course.
First hour
Factory reset both phones Tell everyone by email Forget it
Destroys evidence and tips off whoever is watching.
Block the domain Isolate the phones, keep them on Call specialists Update the fleet
Stops the leak and keeps options open.
What a defender takes away
- 1Mobile compromises often show first on the network.
- 2Two phones, one unknown domain and messaging traffic just before is worth an escalation.
- 3Patch, Lockdown Mode for high-risk staff and regular reboots answer this whole class.
Questions
0 of 4 solved
Answer each one from what you find on your lab machine.