Coruna iOS Exploit Kit — Government-Grade 23-Exploit Arsenal Proliferates from Surveillance Vendor to Russian Espionage and Chinese Cybercriminals Targeting 42K+ Devices

Coruna iOS Exploit Kit (TL-2026-0174), also tracked as Coruna, is a critical-severity zero-day vulnerability scored CVSS 9.8, first published 2026-03-04. It is attributed to L3Harris Trenchant (Russia) with medium confidence, affects Apple iOS, references 6 CVEs (CVE-2024-23222, CVE-2022-48503, CVE-2023-43000), maps to 23 MITRE ATT&CK techniques (T1005, T1027, T1037), and is covered by 9 detection rules and 18 indicators of compromise.

Key facts for TL-2026-0174

Threat ID
TL-2026-0174
Also known as
Coruna, Operation Triangulation toolkit evolution
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Status
PATCHED
Category
ZERO_DAY
First published
2026-03-04
Last reviewed
2026-03-04
Attribution
L3Harris Trenchant
Attribution confidence
MEDIUM
Nation-state nexus
Russia
Motivation
ESPIONAGE
Target sectors
government, defense, financial, technology, media, cryptocurrency
Target regions
Ukraine, China, Global, Eastern Europe
Detection rules
9
Indicators of compromise
18

Malware and tooling in Coruna iOS Exploit Kit

Malware and tooling: Coruna

Google Threat Intelligence Group and iVerify disclosed Coruna, a sophisticated iOS exploit kit containing 5 full exploit chains and 23 individual exploits targeting iOS 13.0 through 17.2.1. The kit proliferated from a surveillance vendor customer to Russian espionage operations against Ukraine and Chinese financially motivated campaigns affecting 42,000+ devices.

How Coruna iOS Exploit Kit works

Google Threat Intelligence Group (TAG) and iVerify published coordinated research on March 3, 2026 documenting Coruna, an exceptionally sophisticated iOS exploit kit containing 5 complete exploit chains and 23 individual exploits spanning iOS 13.0 (September 2019) through iOS 17.2.1 (December 2023). The research represents one of the most significant documented cases of government-grade exploit proliferation from surveillance vendors to both state-sponsored espionage groups and financially motivated cybercriminals.

Coruna chains multiple WebKit memory handling vulnerabilities for initial remote code execution, followed by sandbox escape and kernel exploitation to achieve full device compromise. The kit exploits at least six confirmed CVEs: CVE-2024-23222 (WebKit type confusion, CVSS 8.8, CISA KEV), CVE-2022-48503 (WebKit bounds check bypass, CVSS 8.8, CISA KEV as of October 2025), CVE-2023-43000 (WebKit use-after-free leading to memory corruption), CVE-2023-38606 (kernel state modification, actively exploited in Operation Triangulation), CVE-2023-32434 (kernel integer overflow enabling arbitrary code execution with kernel privileges, actively exploited in Operation Triangulation), and CVE-2023-32409 (WebKit sandbox escape, CVSS 8.6, actively exploited). Additional exploits within the kit lack CVE assignments but employ non-public exploitation techniques and mitigation bypasses.

iVerify's analysis linked Coruna's foundations to the same tooling used in Operation Triangulation, the sophisticated iOS surveillance campaign that Kaspersky discovered in 2023 targeting its own employees. Russian authorities attributed Operation Triangulation to U.S. intelligence services. CyberScoop reported that Coruna code contained comments suggesting U.S. government origin, and security researchers described the code as 'superb' with 'elegant' writing — hallmarks of well-resourced development teams.

The kit's attack methodology begins with hidden JavaScript on malicious websites that performs device reconnaissance, checking device model, iOS version, and security settings before selecting the appropriate exploit chain. Critically, Coruna detects and aborts execution when encountering Apple's Lockdown Mode or private browsing mode, demonstrating awareness of iOS security hardening features.

Google TAG documented three distinct deployment campaigns representing the kit's proliferation trajectory:

1. February 2025 — A commercial surveillance vendor customer deployed Coruna for targeted surveillance operations. The specific vendor and targets remain unnamed.

2. July 2025 — A suspected Russian espionage group deployed Coruna in watering hole attacks against Ukrainian websites, leveraging the ongoing Russia-Ukraine conflict for intelligence collection.

3. December 2025 — Chinese financially motivated cybercriminals deployed Coruna via fake gambling and cryptocurrency websites, achieving mass-scale infection of over 42,000 devices. iVerify's Chief Product Officer Spencer Parker termed this the first 'mass-scale attack on iOS' using government-grade exploit capabilities.

Payloads observed in the financially motivated campaign focused on cryptocurrency theft. The malicious stager binary could decode QR codes from disk images, search for keywords including 'backup phrase' and 'bank account', and exfiltrate cryptocurrency wallet data targeting applications including Metamask and BitKeep.

The Coruna kit is not effective against current iOS versions. Apple's security updates have addressed all known CVEs exploited by the kit. Lockdown Mode and private browsing both trigger evasion checks that prevent execution, making these effective defensive measures for at-risk users.

This case demonstrates the accelerating trickle-down of government-grade offensive cyber capabilities into the broader threat landscape, where exploit kits developed at enormous cost by nation-state programs or their surveillance vendor proxies eventually reach criminal actors who deploy them at scale.

---

**Revalidated on 2026-03-12**

Since initial publication on March 4, 2026, the Coruna threat landscape has evolved substantially with critical developments across law enforcement, sanctions, patching, and attribution domains.

### Proliferation Vector Confirmed: L3Harris Trenchant Insider Theft The full provenance of Coruna's proliferation has been established through court proceedings and investigative journalism. Peter Williams, a 39-year-old Australian citizen and former general manager at L3Harris's Trenchant offensive cyber division (previously an officer in Australia's Signals Directorate), stole at least eight exploit components from Trenchant between 2022 and mid-2025. He sold these to Operation Zero (Matrix LLC), a Russian exploit broker owned by Sergey Sergeyevich Zelenyuk that publicly markets itself as a platform for purchasing zero-day vulnerabilities. Williams received $1.3 million in cryptocurrency, while DOJ estimated $35 million in losses to L3Harris. One former L3Harris employee confirmed to TechCrunch that 'Coruna was definitely an internal name of a component,' and that L3Harris sells Trenchant's tools exclusively to the U.S. government and Five Eyes intelligence alliance partners. Williams pleaded guilty on October 29, 2025 and was sentenced to 87 months in federal prison on February 24, 2026.

### U.S. Government Sanctions and Enforcement On February 24, 2026, the U.S. Treasury Department's OFAC sanctioned Zelenyuk, Matrix LLC/Operation Zero, and five associated individuals and entities under the Protecting American Intellectual Property Act (PAIPA) — the first time PAIPA has been used against a foreign exploit broker. Sanctioned parties include Marina Vasanovich (Zelenyuk's assistant), Oleg Kucherov (identified as a suspected Trickbot member), Azizjon Mamashoyev and his exploit brokerage Advance Security Solutions, and Special Technology Services (a UAE-controlled entity). The State Department issued parallel designations.

### CISA KEV Additions On March 5, 2026, CISA added three previously unreported exploited CVEs from the Coruna kit to the Known Exploited Vulnerabilities catalog: CVE-2021-30952 (WebKit, affects tvOS/macOS/Safari/iPadOS/watchOS, arbitrary code execution), CVE-2023-41974 (iOS/iPadOS kernel, arbitrary code execution with kernel privileges), and CVE-2023-43000 (codenamed 'terrorbird,' WebKit use-after-free, memory corruption via crafted web content). Federal agencies must remediate by March 26, 2026. This expands the known Coruna CVE count beyond the six originally documented.

### Apple Legacy Device Patches On March 11, 2026, Apple released iOS 15.8.7, iOS 16.7.15, iPadOS 15.8.7, and iPadOS 16.7.15, explicitly confirming these updates address Coruna-exploited kernel and WebKit vulnerabilities on legacy devices that cannot run iOS 17+. Supported devices extend back to iPhone 6s, making these critical updates for the substantial installed base of older hardware still in active use.

### Attribution Disputes Kaspersky's GReAT team publicly disputed claims connecting Coruna to Operation Triangulation and the NSA, with principal researcher Boris Larin stating they found 'no evidence of actual code reuse' despite both campaigns exploiting CVE-2023-32434 and CVE-2023-38606. Kaspersky noted that publicly available exploit implementations exist for those CVEs, and any sufficiently resourced actor could develop independent exploits.

### Expanded Technical Understanding GTIG's full analysis confirmed PlasmaLoader (PLASMAGRID) uses com.apple.assistd as its process identifier, injects into the powerd root daemon, and hooks into 18 cryptocurrency wallet applications. Beyond the originally noted MetaMask and BitKeep targeting, the payload also targets Phantom, Exodus, Uniswap, and 13 additional wallets. The malware decodes QR codes from stored images and scans text for BIP39 seed word sequences alongside keywords like 'backup phrase' and 'bank account,' including in Apple Memos. Coruna incorporates four layers of obfuscation to bypass static analysis and automated sandboxes. The rwx_allocator module employs multiple techniques to bypass RWX memory page allocation mitigations, while kernel exploits embed modules to bypass kernel-mode PAC (Pointer Authentication Code).

### Updated CVE Inventory The confirmed CVE list exploited by Coruna now includes nine CVEs: CVE-2024-23222, CVE-2022-48503, CVE-2023-43000, CVE-2023-38606, CVE-2023-32434, CVE-2023-32409 (original six), plus CVE-2021-30952, CVE-2023-41974, and CVE-2023-43010 (newly confirmed via CISA KEV and Apple's legacy patches).

MITRE ATT&CK techniques used in TL-2026-0174

collection

T1005 Data from Local System; T1056 Input Capture; T1113 Screen Capture

defense-evasion

T1027 Obfuscated Files or Information; T1211 Exploitation for Stealth; T1497.001 System Checks

persistence

T1037 Boot or Logon Initialization Scripts

exfiltration

T1041 Exfiltration Over C2 Channel

execution

T1059.007 JavaScript; T1203 Exploitation for Client Execution

privilege-escalation

T1068 Exploitation for Privilege Escalation

command-and-control

T1071.001 Web Protocols; T1102 Web Service; T1105 Ingress Tool Transfer

discovery

T1082 System Information Discovery; T1518 Software Discovery

initial-access

T1189 Drive-by Compromise; T1190 Exploit Public-Facing Application

credential-access

T1555 Credentials from Password Stores

resource-development

T1583.001 Domains; T1587.004 Exploits; T1588.005 Exploits

impact

T1657 Financial Theft

Affected products and versions in Coruna iOS Exploit Kit

  • Apple — iOS
    Vulnerable versions: 13.0; 13.1; 13.2; 13.3; 13.4; 13.5; 13.6; 13.7; 14.0; 14.1
    Fixed in: 17.3

Remediation for Coruna iOS Exploit Kit

Patches

  • [object Object]
  • [object Object]

Immediate actions

  • Update all iOS devices to iOS 17.3 or later immediately — this patches all 6 CVEs in the Coruna exploit chain
  • Enable Lockdown Mode on all high-value targets (executives, journalists, government officials) — Coruna explicitly detects and aborts on Lockdown Mode
  • Block known Coruna C2 domains and CDN-fronted exfiltration endpoints at the network perimeter
  • Revoke and rotate credentials on any device running iOS 13.0–17.2.1 that may have visited compromised sites
  • Audit cryptocurrency wallet applications (MetaMask, BitKeep, Trust Wallet, Coinbase Wallet) for unauthorized transactions

Workarounds

  • Enable Lockdown Mode (Settings > Privacy & Security > Lockdown Mode) — disables JIT compilation, WebAssembly, and other attack surface that Coruna relies on
  • Restrict Safari JavaScript execution on untrusted sites via Content Blockers or Supervised Mode profiles
  • Use VPN with DNS filtering to block known watering hole domains and TDS infrastructure
  • Disable automatic link previews in messaging apps to prevent drive-by exploit delivery
  • Remove or isolate cryptocurrency wallet apps from devices that cannot be updated to iOS 17.3+

Longer-term hardening

  • Enforce iOS version compliance via MDM — block devices below iOS 17.3 from accessing corporate resources
  • Deploy network monitoring for exploit kit traffic patterns: multi-hop redirects through TDS infrastructure, CDN-fronted POST exfiltration with mismatched Host/X-Forwarded-Host headers
  • Implement certificate pinning validation for critical mobile applications to detect MitM interception
  • Establish CrashReporter log retention and monitoring — Coruna deletes WebKit crash logs as anti-forensic measure
  • Monitor for IOSurface kernel exploit indicators in device diagnostic logs

CVEs associated with Coruna iOS Exploit Kit

CVE-2024-23222, CVE-2022-48503, CVE-2023-43000, CVE-2023-38606, CVE-2023-32434, CVE-2023-32409

Weaknesses (CWE) in Coruna iOS Exploit Kit

CWE-843, CWE-119, CWE-416, CWE-190

Timeline of Coruna iOS Exploit Kit

Showing the 20 most recent tracked events.

  • Kaspersky discloses Operation Triangulation — sophisticated iOS surveillance campaign exploiting CVE-2023-32434 and CVE-2023-38606 targeting Kaspersky employees.
  • Apple patches CVE-2023-32434 (kernel integer overflow, Operation Triangulation) in iOS 16.5.1.
  • Apple patches CVE-2023-38606 (kernel state modification, Operation Triangulation) in iOS 16.6.
  • Apple patches CVE-2024-23222 (WebKit type confusion, CVSS 8.8, exploited in wild) in iOS 17.3. CISA adds to KEV catalog.
  • First observed deployment of complete Coruna exploit kit by commercial surveillance vendor customer for targeted operations.
  • Suspected Russian espionage group deploys Coruna in watering hole attacks against Ukrainian websites during ongoing conflict.
  • CISA adds CVE-2022-48503 to Known Exploited Vulnerabilities catalog, confirming active exploitation.
  • Peter Williams, former L3Harris Trenchant general manager and ex-Australian Signals Directorate officer, pleads guilty to two counts of theft of trade secrets for stealing eight exploit components from Trenchant and selling them to Russian broker Operation Zero for $1.3 million in cryptocurrency. [Source: https://techcrunch.com/2025/10/29/former-l3harris-trenchant-boss-pleads-guilty-to-selling-zero-day-exploits-to-russian-broker/]
  • Chinese financially motivated cybercriminals deploy Coruna via fake gambling and cryptocurrency websites, compromising 42,000+ iOS devices — first mass-scale iOS exploit kit attack.
  • DOJ reveals scope of Williams theft — exploits sold to Operation Zero were capable of accessing ''millions of computers and devices,'' with estimated $35 million in losses to L3Harris. [Source: https://techcrunch.com/2026/02/11/doj-says-trenchant-boss-sold-exploits-to-russian-broker-capable-of-accessing-millions-of-computers-and-devices/]
  • U.S. Department of the Treasury designates Operation Zero, Sergey Zelenyuk, Marina Vasanovich, Oleg Kucherov (suspected Trickbot member), Azizjon Mamashoyev, Special Technology Services (UAE), and Advance Security Solutions under sanctions for acquisition and distribution of stolen U.S. cyber tools. [Source: https://home.treasury.gov/news/press-releases/sb0404]
  • Peter Williams sentenced to 87 months in federal prison. Same day, U.S. Treasury OFAC sanctions Sergey Zelenyuk, Matrix LLC (Operation Zero), and five associated individuals/entities under PAIPA — first use of PAIPA against a foreign exploit broker. [Source: https://techcrunch.com/2026/02/24/former-l3harris-trenchant-boss-jailed-for-selling-hacking-tools-to-russian-broker/]
  • Google GTIG and iVerify publish coordinated Coruna disclosure. iVerify terms it the first known ''mass-scale attack on iOS.'' Bleeping Computer reports PlasmaLoader hooks into 18 cryptocurrency wallet apps including MetaMask, Phantom, Exodus, BitKeep, and Uniswap. [Source: https://www.bleepingcomputer.com/news/security/spyware-grade-coruna-ios-exploit-kit-now-used-in-crypto-theft-attacks/]
  • Google Threat Intelligence Group and iVerify publish coordinated research disclosing Coruna exploit kit, documenting proliferation from surveillance vendor to espionage and criminal actors. Source: https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit
  • Kaspersky GReAT dismisses claims that Coruna is connected to Operation Triangulation, stating no evidence of actual code reuse despite shared CVEs (CVE-2023-32434, CVE-2023-38606), noting publicly available implementations exist. [Source: https://www.theregister.com/2026/03/04/kaspersky_dismisses_claims_that_coruna/]
  • MacRumors reports that Coruna self-terminates upon detecting Apple Lockdown Mode, confirming it as the single most effective real-time defense against the exploit kit. [Source: https://www.macrumors.com/2026/03/05/ios-exploit-kit-lockdown-mode-stops-it/]
  • CISA adds three Coruna-exploited CVEs — CVE-2021-30952, CVE-2023-41974, CVE-2023-43000 — to Known Exploited Vulnerabilities catalog. Federal remediation deadline set for March 26, 2026. [Source: https://www.scworld.com/news/3-apple-flaws-from-coruna-exploit-kit-added-to-cisa-vulnerability-list]
  • TechCrunch publishes investigation attributing Coruna development to L3Harris Trenchant division, citing two former employees. One states ''Coruna was definitely an internal name of a component.'' L3Harris sells Trenchant tools exclusively to U.S. government and Five Eyes alliance. [Source: https://techcrunch.com/2026/03/09/an-iphone-hacking-toolkit-used-by-russian-spies-likely-came-from-u-s-military-contractor/]
  • Apple releases iOS 15.8.7 and iOS 16.7.15 (with matching iPadOS versions) backporting Coruna-related kernel and WebKit patches to legacy devices including iPhone 6s, iPhone 7, iPhone SE (1st gen), iPad Air 2, iPad mini (4th gen), and iPod touch (7th gen). [Source: https://9to5mac.com/2026/03/11/apple-confirms-todays-ios-and-ipados-updates-for-older-devices-address-the-coruna-exploit/]
  • As of 2026-05-29, Coruna remains PATCHED and not actively viable: Apple fixed all known CVEs in iOS 17.3 and backported them to legacy devices (15.8.7/16.7.15, Mar 2026), the kit only targets iOS 13.0–17.2.1, and it self-aborts on Lockdown Mode. The broker was disrupted (Williams jailed 87mo, Operation Zero/Zelenyuk OFAC-sanctioned Feb 2026); no new campaigns surfaced after the Mar 2026 disclosures.

Sources cited for Coruna iOS Exploit Kit

Threats related to Coruna iOS Exploit Kit

Detection coverage for TL-2026-0174

As of 2026-03-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0174 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats