Vulnerabilities · 232 days ago
Researchers attribute mass-scale iPhone exploitation to a sophisticated iOS exploit kit called Coruna. The kit contains five exploit chains and 23 exploits that target iOS 13 through 17.2.1. Researchers traced Coruna from a surveillance-customer operation to suspected Russian espionage and then to financially motivated actors targeting government and financial sectors.
9 sources covering this story
Apple Issues Security Updates for Older iOS Devices Targeted by Coruna WebKit Exploit
Apple backports CVE-2023-43010 WebKit fix after Coruna exploit kit abused iOS flaws, protecting older iPhones and iPads from memory corruption attacks
Feds take notice of iOS vulnerabilities exploited under mysterious circumstances
The long, strange trip of a large assembly of advanced iOS exploits.
CISA warns feds to patch iOS flaws exploited in crypto-theft attacks
federal agencies to patch three iOS security flaws targeted in cyberespionage and crypto-theft attacks using the Coruna exploit kit.
Coruna Exploit Kit Targets Older iPhones in Multi-Stage Campaigns
Exploit kit
Coruna iOS exploit kit moved from spy tool to mass criminal campaign in under a year
Google and iVerify researchers say the case points to a thriving secondary market for high-end zero-day exploits.
Nation-State iOS Exploit Kit ‘Coruna’ Found Powering Global Attacks
Google and iVerify analysis reveals a powerful exploit kit originally used by Russian state actors that is now appearing in broader criminal campaigns.
Coruna iOS Exploit Kit Uses 23 Exploits Across Five Chains Targeting iOS 13–17.2.1
Google uncovered Coruna iOS exploit kit with 23 exploits across five chains targeting iPhones running iOS 13–17.2.1.
Spyware-grade Coruna iOS exploit kit now used in crypto theft attacks
A previously undocumented set of 23 iOS exploits named "Coruna" has been deployed by multiple threat actors in targeted espionage campaigns and financially motivated attacks.
Possible U.S.-developed exploits linked to first known ‘mass’ iOS attack
Researchers uncover "Coruna," a sophisticated iOS exploit kit likely leaked from a U.S.
Coruna: Spy-grade iOS exploit kit powering financial crime - Help Net Security
The Coruna iOS exploit kit has circulated among multiple threat actors: a customer of a surveillance company, cyberspies, and crypto-thieves.
Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit | Google Cloud Blog
Coruna is a powerful iOS exploit kit leveraging 23 vulnerabilities across multiple threat actors and global campaigns.
Part of the PlainSec briefing for 2026-03-07