Vulnerabilities · 187 days ago
Google GTIG and iVerify uncovered Coruna, a nation‑state‑grade iOS exploit kit with 23 exploits across five exploit chains that targets iOS 13–17.2.1 and has been used by UNC6353 and later criminal actors in watering‑hole and fake financial‑site campaigns against government and financial users. Mitigate by updating devices to iOS 17.3+, enabling Lockdown Mode if you cannot update, hunting telemetry for iOS 13–17.2.1 indicators, blocking known watering‑hole domains, and isolating compromised devices for forensic imaging.
9 sources covering this story
Apple Issues Security Updates for Older iOS Devices Targeted by Coruna WebKit Exploit
Apple backports CVE-2023-43010 WebKit fix after Coruna exploit kit abused iOS flaws, protecting older iPhones and iPads from memory corruption attacks
Feds take notice of iOS vulnerabilities exploited under mysterious circumstances
The long, strange trip of a large assembly of advanced iOS exploits.
CISA warns feds to patch iOS flaws exploited in crypto-theft attacks
federal agencies to patch three iOS security flaws targeted in cyberespionage and crypto-theft attacks using the Coruna exploit kit.
Coruna Exploit Kit Targets Older iPhones in Multi-Stage Campaigns
Exploit kit
Coruna iOS exploit kit moved from spy tool to mass criminal campaign in under a year
Google and iVerify researchers say the case points to a thriving secondary market for high-end zero-day exploits.
Nation-State iOS Exploit Kit ‘Coruna’ Found Powering Global Attacks
Google and iVerify analysis reveals a powerful exploit kit originally used by Russian state actors that is now appearing in broader criminal campaigns.
Coruna iOS Exploit Kit Uses 23 Exploits Across Five Chains Targeting iOS 13–17.2.1
Google uncovered Coruna iOS exploit kit with 23 exploits across five chains targeting iPhones running iOS 13–17.2.1.
Spyware-grade Coruna iOS exploit kit now used in crypto theft attacks
A previously undocumented set of 23 iOS exploits named "Coruna" has been deployed by multiple threat actors in targeted espionage campaigns and financially motivated attacks.
Possible U.S.-developed exploits linked to first known ‘mass’ iOS attack
Researchers uncover "Coruna," a sophisticated iOS exploit kit likely leaked from a U.S.
Coruna: Spy-grade iOS exploit kit powering financial crime - Help Net Security
The Coruna iOS exploit kit has circulated among multiple threat actors: a customer of a surveillance company, cyberspies, and crypto-thieves.
Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit | Google Cloud Blog
Coruna is a powerful iOS exploit kit leveraging 23 vulnerabilities across multiple threat actors and global campaigns.
Part of the PlainSec briefing for 2026-03-15