# Coruna iOS Exploit Kit — Government-Grade 23-Exploit Arsenal Proliferates from Surveillance Vendor to Russian Espionage and Chinese Cybercriminals Targeting 42K+ Devices

> Google Threat Intelligence Group and iVerify disclosed Coruna, a sophisticated iOS exploit kit containing 5 full exploit chains and 23 individual exploits targeting iOS 13.0 through 17.2.1. The kit proliferated from a surveillance vendor customer to Russian espionage operations against Ukraine and Chinese financially motivated campaigns affecting 42,000+ devices.

- **Published:** 2026-03-04T03:50:00Z
- **Last reviewed:** 2026-03-04T03:50:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0174
- **ID:** TL-2026-0174
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** ZERO_DAY
- **Status:** PATCHED
- **Actor:** L3Harris Trenchant (Russia)
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-23222, CVE-2022-48503, CVE-2023-43000, CVE-2023-38606, CVE-2023-32434, CVE-2023-32409, CVE-2021-30952, CVE-2023-41974, CVE-2023-43010

## Description

Google Threat Intelligence Group (TAG) and iVerify published coordinated research on March 3, 2026 documenting Coruna, an exceptionally sophisticated iOS exploit kit containing 5 complete exploit chains and 23 individual exploits spanning iOS 13.0 (September 2019) through iOS 17.2.1 (December 2023). The research represents one of the most significant documented cases of government-grade exploit proliferation from surveillance vendors to both state-sponsored espionage groups and financially motivated cybercriminals.

Coruna chains multiple WebKit memory handling vulnerabilities for initial remote code execution, followed by sandbox escape and kernel exploitation to achieve full device compromise. The kit exploits at least six confirmed CVEs: CVE-2024-23222 (WebKit type confusion, CVSS 8.8, CISA KEV), CVE-2022-48503 (WebKit bounds check bypass, CVSS 8.8, CISA KEV as of October 2025), CVE-2023-43000 (WebKit use-after-free leading to memory corruption), CVE-2023-38606 (kernel state modification, actively exploited in Operation Triangulation), CVE-2023-32434 (kernel integer overflow enabling arbitrary code execution with kernel privileges, actively exploited in Operation Triangulation), and CVE-2023-32409 (WebKit sandbox escape, CVSS 8.6, actively exploited). Additional exploits within the kit lack CVE assignments but employ non-public exploitation techniques and mitigation bypasses.

iVerify's analysis linked Coruna's foundations to the same tooling used in Operation Triangulation, the sophisticated iOS surveillance campaign that Kaspersky discovered in 2023 targeting its own employees. Russian authorities attributed Operation Triangulation to U.S. intelligence services. CyberScoop reported that Coruna code contained comments suggesting U.S. government origin, and security researchers described the code as 'superb' with 'elegant' writing — hallmarks of well-resourced development teams.

The kit's attack methodology begins with hidden JavaScript on malicious websites that performs device reconnaissance, checking device model, iOS version, and security settings before selecting the appropriate exploit chain. Critically, Coruna detects and aborts execution when encountering Apple's Lockdown Mode or private browsing mode, demonstrating awareness of iOS security hardening features.

Google TAG documented three distinct deployment campaigns representing the kit's proliferation trajectory:

1. February 2025 — A commercial surveillance vendor customer deployed Coruna for targeted surveillance operations. The specific vendor and targets remain unnamed.

2. July 2025 — A suspected Russian espionage group deployed Coruna in watering hole attacks against Ukrainian websites, leveraging the ongoing Russia-Ukraine conflict for intelligence collection.

3. December 2025 — Chinese financially motivated cybercriminals deployed Coruna via fake gambling and cryptocurrency websites, achieving mass-scale infection of over 42,000 devices. iVerify's Chief Product Officer Spencer Parker termed this the first 'mass-scale attack on iOS' using government-grade exploit capabilities.

Payloads observed in the financially motivated campaign focused on cryptocurrency theft. The malicious stager binary could decode QR codes from disk images, search for keywords including 'backup phrase' and 'bank account', and exfiltrate cryptocurrency wallet data targeting applications including Metamask and BitKeep.

The Coruna kit is not effective against current iOS versions. Apple's security updates have addressed all known CVEs exploited by the kit. Lockdown Mode and private browsing both trigger evasion checks that prevent execution, making these effective defensive measures for at-risk users.

This case demonstrates the accelerating trickle-down of government-grade offensive cyber capabilities into the broader threat landscape, where exploit kits developed at enormous cost by nation-state programs or their surveillance vendor proxies eventually reach criminal actors who deploy them at scale.

---

**Revalidated on 2026-03-12**

Since initial publication on March 4, 2026, the Coruna threat landscape has evolved substantially with critical developments across law enforcement, sanctions, patching, and attribution domains.

### Proliferation Vector Confirmed: L3Harris Trenchant Insider Theft
The full provenance of Coruna's proliferation has been established through court proceedings and investigative journalism. Peter Williams, a 39-year-old Australian citizen and former general manager at L3Harris's Trenchant offensive cyber division (previously an officer in Australia's Signals Directorate), stole at least eight exploit components from Trenchant between 2022 and mid-2025. He sold these to Operation Zero (Matrix LLC), a Russian exploit broker owned by Sergey Sergeyevich Zelenyuk that publicly markets itself as a platform for purchasing zero-day vulnerabilities. Williams received $1.3 million in cryptocurrency, while DOJ estimated $35 million in losses to L3Harris. One former L3Harris employee confirmed to TechCrunch that 'Coruna was definitely an internal name of a component,' and that L3Harris sells Trenchant's tools exclusively to the U.S. government and Five Eyes intelligence alliance partners. Williams pleaded guilty on October 29, 2025 and was sentenced to 87 months in federal prison on February 24, 2026.

### U.S. Government Sanctions and Enforcement
On February 24, 2026, the U.S. Treasury Department's OFAC sanctioned Zelenyuk, Matrix LLC/Operation Zero, and five associated individuals and entities under the Protecting American Intellectual Property Act (PAIPA) — the first time PAIPA has been used against a foreign exploit broker. Sanctioned parties include Marina Vasanovich (Zelenyuk's assistant), Oleg Kucherov (identified as a suspected Trickbot member), Azizjon Mamashoyev and his exploit brokerage Advance Security Solutions, and Special Technology Services (a UAE-controlled entity). The State Department issued parallel designations.

### CISA KEV Additions
On March 5, 2026, CISA added three previously unreported exploited CVEs from the Coruna kit to the Known Exploited Vulnerabilities catalog: CVE-2021-30952 (WebKit, affects tvOS/macOS/Safari/iPadOS/watchOS, arbitrary code execution), CVE-2023-41974 (iOS/iPadOS kernel, arbitrary code execution with kernel privileges), and CVE-2023-43000 (codenamed 'terrorbird,' WebKit use-after-free, memory corruption via crafted web content). Federal agencies must remediate by March 26, 2026. This expands the known Coruna CVE count beyond the six originally documented.

### Apple Legacy Device Patches
On March 11, 2026, Apple released iOS 15.8.7, iOS 16.7.15, iPadOS 15.8.7, and iPadOS 16.7.15, explicitly confirming these updates address Coruna-exploited kernel and WebKit vulnerabilities on legacy devices that cannot run iOS 17+. Supported devices extend back to iPhone 6s, making these critical updates for the substantial installed base of older hardware still in active use.

### Attribution Disputes
Kaspersky's GReAT team publicly disputed claims connecting Coruna to Operation Triangulation and the NSA, with principal researcher Boris Larin stating they found 'no evidence of actual code reuse' despite both campaigns exploiting CVE-2023-32434 and CVE-2023-38606. Kaspersky noted that publicly available exploit implementations exist for those CVEs, and any sufficiently resourced actor could develop independent exploits.

### Expanded Technical Understanding
GTIG's full analysis confirmed PlasmaLoader (PLASMAGRID) uses com.apple.assistd as its process identifier, injects into the powerd root daemon, and hooks into 18 cryptocurrency wallet applications. Beyond the originally noted MetaMask and BitKeep targeting, the payload also targets Phantom, Exodus, Uniswap, and 13 additional wallets. The malware decodes QR codes from stored images and scans text for BIP39 seed word sequences alongside keywords like 'backup phrase' and 'bank account,' including in Apple Memos. Coruna incorporates four layers of obfuscation to bypass static analysis and automated sandboxes. The rwx_allocator module employs multiple techniques to bypass RWX memory page allocation mitigations, while kernel exploits embed modules to bypass kernel-mode PAC (Pointer Authentication Code).

### Updated CVE Inventory
The confirmed CVE list exploited by Coruna now includes nine CVEs: CVE-2024-23222, CVE-2022-48503, CVE-2023-43000, CVE-2023-38606, CVE-2023-32434, CVE-2023-32409 (original six), plus CVE-2021-30952, CVE-2023-41974, and CVE-2023-43010 (newly confirmed via CISA KEV and Apple's legacy patches).

## MITRE ATT&CK

- T1583.001 Domains
- T1587.004 Exploits
- T1588.005 Exploits
- T1189 Drive-by Compromise
- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1059.007 JavaScript
- T1037 Boot or Logon Initialization Scripts
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1497.001 System Checks
- T1027 Obfuscated Files or Information
- T1082 System Information Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1113 Screen Capture
- T1056 Input Capture
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel
- T1555 Credentials from Password Stores
- T1657 Financial Theft

## Sources

- [Google TAG — Coruna: A Powerful iOS Exploit Kit](https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit)
- [Help Net Security — Coruna iOS Exploit Kit Analysis](https://www.helpnetsecurity.com/2026/03/03/coruna-ios-exploit-kit/)
- [CyberScoop — Coruna iOS Exploit Kit Leaked US Framework](https://cyberscoop.com/coruna-ios-exploit-kit-leaked-us-framework/)
- [TechCrunch — Government Hacking Tools Targeting iPhones Used by Cybercriminals](https://techcrunch.com/2026/03/03/a-suite-of-government-hacking-tools-targeting-iphones-is-now-being-used-by-cybercriminals/)
- [9to5Mac — Google and iVerify Reveal Government-Grade iPhone Exploit Kit](https://9to5mac.com/2026/03/03/google-and-iverify-reveal-government-grade-iphone-exploit-kit-spreading-to-hackers/)
- [NVD — CVE-2024-23222 WebKit Type Confusion (CVSS 8.8)](https://nvd.nist.gov/vuln/detail/CVE-2024-23222)
- [CISA KEV — CVE-2024-23222 Apple WebKit Exploited in Wild](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23222)
- [NVD — CVE-2023-32434 Kernel Integer Overflow (Operation Triangulation)](https://nvd.nist.gov/vuln/detail/CVE-2023-32434)
- [Apple Security Advisory — iOS 17.3 and iPadOS 17.3 (HT214055)](https://support.apple.com/en-us/HT214055)
- [Kaspersky — Operation Triangulation: The Last (Hardware) Mystery](https://securelist.com/operation-triangulation-the-last-hardware-mystery/111669/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0174