Coruna iOS Exploit Kit — 23 Exploits Across 5 Chains Targeting iOS 13-17.2.1 (CVE-2021-30952, CVE-2023-41974, CVE-2023-43000 + 20 More)

Coruna iOS Exploit Kit (TL-2026-0186), also tracked as Coruna, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-03-06 and last reviewed 2026-08-17. It is attributed to UNC6353 (Russia, China) with high confidence, affects Apple iOS, references 24 CVEs (CVE-2021-30952, CVE-2023-41974, CVE-2023-43000), maps to 28 MITRE ATT&CK techniques (T1005, T1008, T1027), and is covered by 9 detection rules and 39 indicators of compromise.

Key facts for TL-2026-0186

Threat ID
TL-2026-0186
Also known as
Coruna, CryptoWaters, PLASMAGRID
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
2026-03-06
Last reviewed
2026-08-17
Attribution
UNC6353
Attribution confidence
HIGH
Nation-state nexus
Russia, China
Motivation
ESPIONAGE
Target sectors
government, defense, financial, technology, cryptocurrency, retail, industrial, e-commerce, media, civil-society
Target regions
Ukraine, Eastern Europe, China, Southeast Asia, Global
Detection rules
9
Indicators of compromise
39
Updates
2026-08-17 · revalidated 1× · latest source

Malware and tooling in Coruna iOS Exploit Kit

Malware and tooling: PLASMAGRID, PlasmaLoader, Coruna, Coruna JavaScript Framework

Google Threat Intelligence Group (GTIG) identified Coruna, a commercial-grade iOS exploit kit containing 23 exploits across 5 full exploit chains targeting iOS 13.0 through 17.2.1. Initially deployed by a surveillance vendor customer, the kit proliferated to UNC6353 (Russian espionage targeting Ukraine) and UNC6691 (Chinese financially motivated actors stealing cryptocurrency). CISA added CVE-2021-30952, CVE-2023-41974, and CVE-2023-43000 to KEV on March 5, 2026. The final-stage payload PlasmaLoader (PLASMAGRID) injects into the powerd root daemon to exfiltrate cryptocurrency wallets and seed phrases.

How Coruna iOS Exploit Kit works

Coruna is a sophisticated, modular iOS exploit kit first observed by Google's Threat Intelligence Group (GTIG) in February 2025, when researchers captured an iOS exploit chain used by a customer of a commercial surveillance vendor. The kit represents one of the most comprehensive iOS exploitation frameworks ever documented, containing 23 individual exploits organized into 5 full attack chains that collectively target every iOS version from 13.0 (September 2019) through 17.2.1 (December 2023).

The exploit kit combines WebKit memory corruption vulnerabilities for initial remote code execution, sandbox escape exploits, kernel privilege escalation, Pointer Authentication Code (PAC) bypasses, and Page Protection Layer (PPL) bypasses to achieve full device compromise. The individual exploit components carry internal codenames including buffout (CVE-2021-30952), Photon (CVE-2023-32434), Gallium (CVE-2023-38606), IronLoader (CVE-2023-32409), Parallax (CVE-2023-41974), terrorbird (CVE-2023-43000), and others. Notably, the Photon and Gallium components were previously linked to Operation Triangulation, the iOS espionage campaign revealed by Kaspersky in 2023.

The infection vector uses a JavaScript framework that fingerprints the target device, determines the appropriate exploit chain based on iOS version, loads a WebKit RCE exploit, executes a PAC bypass, and deploys the payload via a hidden iFrame. The framework includes evasion mechanisms — it terminates if Lockdown Mode is enabled and exits in private browsing mode. Payloads are encrypted using LZW compression combined with ChaCha20 encryption.

The final-stage payload is PlasmaLoader (tracked by GTIG as PLASMAGRID), a stager binary that uses the identifier com.apple.assistd and injects itself into powerd, a daemon running as root on iOS. PlasmaLoader is designed to decode QR codes from images, hook into 18+ cryptocurrency wallet applications (including MetaMask, Phantom, Exodus, BitKeep, TokenPocket, Uniswap, Base, Bitget Wallet), and scan Apple Notes for BIP39 seed phrases and keywords like 'backup phrase' or 'bank account'. Stolen data is encrypted with AES before exfiltration to hardcoded C2 servers.

The implant embeds a custom domain generation algorithm (DGA) using the string 'lazarus' as a seed to generate predictable 15-character domains with .xyz TLD as fallback C2 channels. Network indicators include anomalous HTTP headers 'sdkv' and 'x-ts' in C2 communications.

Proliferation occurred across three distinct phases. In February 2025, GTIG first observed the kit deployed by a surveillance vendor customer in highly targeted operations. By July 2025, the JavaScript framework appeared on cdn.uacounter[.]com in watering hole attacks targeting Ukrainian websites spanning industrial equipment, retail, and e-commerce sectors, attributed to UNC6353, a suspected Russian espionage group. The exploit was selectively triggered only for iPhone users in specific geographic regions. By December 2025, the complete kit was weaponized by UNC6691, a financially motivated Chinese threat actor, across a network of fraudulent cryptocurrency and financial websites (including fake WEEX exchange sites) with no geolocation filtering — marking the first observed mass exploitation campaign against iOS devices using spyware-grade exploit chains.

Code analysis revealed comments written in Chinese within the UNC6691 campaign modules, and evidence of large language model-generated content in some components. iVerify independently tracks this framework as CryptoWaters and has noted similarities to frameworks previously developed by threat actors affiliated with the U.S. government.

On March 5, 2026, CISA added three Coruna-exploited vulnerabilities to the Known Exploited Vulnerabilities catalog: CVE-2021-30952, CVE-2023-41974, and CVE-2023-43000, with a federal remediation deadline of March 26, 2026.

---

**Revalidated on 2026-03-12**

Since the original threat publication, the Coruna iOS exploit kit has been the subject of an extraordinary multi-sector disclosure and response cycle concentrated in late February and early March 2026. The attribution picture has sharpened significantly: former L3Harris Trenchant employees confirmed to TechCrunch (March 9, 2026) that 'Coruna' was an internal component name within Trenchant, the offensive hacking division formed from L3Harris's acquisitions of Australian firms Azimuth Security and Linchpin Labs. Bird-themed exploit codenames in the kit (terrorbird, cassowary, Sparrow) match Trenchant's documented 'Condor' naming convention. The proliferation pathway gained clarity through the Peter Williams case: the former Trenchant general manager was sentenced on February 24, 2026 to 87 months in federal prison for selling eight stolen zero-day exploits to Operation Zero (Matrix LLC), a Russian exploit broker run by Sergey Zelenyuk, for $1.3 million in cryptocurrency. The U.S. Treasury sanctioned Operation Zero and five associates on the same date under the first-ever enforcement of the Protecting American Intellectual Property Act (PAIPA), while the State Department issued parallel designations. Kaspersky's GReAT team (Boris Larin) disputed direct code lineage with their 2023 Operation Triangulation discovery, arguing the two shared CVEs (Photon/CVE-2023-32434 and Gallium/CVE-2023-38606) have publicly available implementations and do not constitute code reuse.

c/side's March 5, 2026 infrastructure analysis revealed 50+ delivery domains spanning Cloudflare proxy, AWS CloudFront, and bulletproof hosting on AS212238 (Datacamp Limited, Hong Kong), with a domain generation algorithm seeded by the string 'lazarus' producing 15-character .xyz C2 domains. JavaScript delivery uses 4-layer XOR/Base64 obfuscation within self-contained HTML files (group.html, analytics.html) embedded as zero-dimension hidden iframes. The framework performs anti-analysis checks including Lockdown Mode detection via IndexDB/MathML operations, private browsing detection, and MathML rendering verification for genuine WebKit engines. CISA added CVE-2021-30952, CVE-2023-41974, and CVE-2023-43000 to KEV on March 5, 2026 with a March 26 federal deadline. Apple released emergency backport patches on March 11, 2026 (iOS 15.8.7, iPadOS 15.8.7, iOS 16.7.15, iPadOS 16.7.15), addressing CVE-2023-41974, CVE-2024-23222, CVE-2023-43000, and CVE-2023-43010 for devices that cannot upgrade to iOS 17+, explicitly confirming the updates address the Coruna exploit. The revalidation confirms this threat remains CRITICAL with active exploitation, expanding victim scope, and the broader implication that surveillance-grade iOS exploit kits are now proliferating from government contractors through exploit brokers into both nation-state espionage and mass criminal operations.

MITRE ATT&CK techniques used in TL-2026-0186

collection

T1005 Data from Local System; T1056 Input Capture; T1113 Screen Capture; T1115 Clipboard Data

command-and-control

T1008 Fallback Channels; T1071 Application Layer Protocol; T1568 Dynamic Resolution; T1573 Encrypted Channel

defense-evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1070 Indicator Removal; T1497 Virtualization/Sandbox Evasion

exfiltration

T1041 Exfiltration Over C2 Channel; T1048 Exfiltration Over Alternative Protocol

privilege-escalation

T1068 Exploitation for Privilege Escalation

discovery

T1082 System Information Discovery; T1518 Software Discovery

execution

T1106 Native API; T1203 Exploitation for Client Execution

initial-access

T1189 Drive-by Compromise; T1190 Exploit Public-Facing Application

persistence

T1554 Compromise Host Software Binary

credential-access

T1555 Credentials from Password Stores

resource-development

T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1588 Obtain Capabilities

impact

T1657 Financial Theft

Affected products and versions in Coruna iOS Exploit Kit

  • Apple — iOS
    Vulnerable versions: 13.0; 13.1; 13.2; 13.3; 13.4; 13.5; 13.6; 13.7; 14.0; 14.1
    Fixed in: 17.3 and later
  • Apple — iPadOS
    Vulnerable versions: 13.0 through 17.2.1
    Fixed in: 17.3 and later
  • Apple — Safari
    Vulnerable versions: Versions bundled with iOS 13.0-17.2.1
    Fixed in: Safari 17.3 and later

Remediation for Coruna iOS Exploit Kit

Patches

  • iOS 15.2 patches CVE-2021-30952
  • iOS 16.7.1 patches CVE-2023-41974, CVE-2023-43000, CVE-2023-42917, CVE-2023-42916
  • iOS 16.7 patches CVE-2023-41993, CVE-2023-41991, CVE-2023-41990
  • iOS 16.6.1 patches CVE-2023-41064, CVE-2023-41061
  • iOS 16.6 patches CVE-2023-38606, CVE-2023-37450
  • iOS 16.5.1 patches CVE-2023-32434, CVE-2023-32435
  • iOS 16.5 patches CVE-2023-32409, CVE-2023-32373, CVE-2023-28204
  • iOS 16.4.1 patches CVE-2023-28206
  • iOS 16.3.1 patches CVE-2023-23529, CVE-2023-23514
  • iOS 16.2 patches CVE-2022-42856

Immediate actions

  • Update all iOS devices to iOS 17.3 or later immediately
  • Enable Lockdown Mode on high-value targets (journalists, executives, government officials)
  • Block cdn.uacounter.com and .xyz DGA domains at DNS/perimeter
  • Monitor for anomalous HTTP headers sdkv and x-ts in network traffic
  • Scan for unauthorized processes using com.apple.assistd identifier
  • Block access to known fraudulent cryptocurrency exchange sites

Workarounds

  • Enable Lockdown Mode to block most exploit chains
  • Avoid clicking links from untrusted sources on iOS devices
  • Disable JavaScript in Safari for high-risk browsing
  • Use hardware security keys instead of software-based crypto wallets on iOS
  • Remove sensitive data from Apple Notes application

Longer-term hardening

  • Deploy mobile threat defense (MTD) solutions capable of detecting exploit kit behavior
  • Implement network monitoring for DGA-generated .xyz domain queries
  • Enforce automatic iOS updates via MDM policy
  • Conduct forensic analysis of any iOS devices that visited compromised Ukrainian sites or fake crypto exchanges
  • Monitor cryptocurrency wallets for unauthorized access or transfers
  • Implement certificate pinning for critical mobile applications

CVEs associated with Coruna iOS Exploit Kit

Weaknesses (CWE) in Coruna iOS Exploit Kit

CWE-119, CWE-120, CWE-125, CWE-190, CWE-20, CWE-295, CWE-362, CWE-416, CWE-787, CWE-843

Timeline of Coruna iOS Exploit Kit

Showing the 20 most recent tracked events.

  • Apple patches CVE-2021-30952 (buffout WebKit exploit) in iOS 15.2
  • Kaspersky discloses Operation Triangulation; Photon and Gallium exploits later found reused in Coruna kit
  • Citizen Lab discloses BLASTPASS exploit chain (CVE-2023-41064 + CVE-2023-41061) used to deliver Pegasus; same CVEs incorporated in Coruna
  • iOS 17.2.1 released — latest version vulnerable to Coruna exploit chains
  • GTIG first captures Coruna iOS exploit chain used by surveillance vendor customer in highly targeted operations
  • UNC6353 deploys Coruna JavaScript framework via cdn.uacounter.com in watering hole attacks targeting Ukrainian industrial and retail websites
  • UNC6691 deploys complete Coruna kit across network of fraudulent Chinese cryptocurrency and financial websites including fake WEEX exchange; debug samples reveal Coruna designation
  • U.S. Treasury Department designates Operation Zero (Matrix LLC) and affiliates under OFAC sanctions for acquisition and distribution of stolen U.S. government cyber tools, marking first enforcement under the Protecting American Intellectual Property Act. [Source: https://home.treasury.gov/news/press-releases/sb0404]
  • Peter Williams, former L3Harris Trenchant general manager, sentenced to 87 months in federal prison for selling eight zero-day exploits to Russian broker Operation Zero for $1.3 million. U.S. Treasury simultaneously sanctions Operation Zero (Matrix LLC), CEO Sergey Zelenyuk, and five associates under the first-ever PAIPA enforcement action. [Source: https://cyberscoop.com/l3harris-executive-peter-williams-sentenced-zero-day-exploits-russia/]
  • iVerify publishes independent analysis of recovered ''CryptoWaters'' sample, characterizing UNC6691 campaign as the first known mass exploitation against iOS devices and noting code similarities to previously attributed U.S. government exploit frameworks. [Source: https://iverify.io/blog/coruna-inside-the-nation-state-grade-ios-exploit-kit-we-ve-been-tracking]
  • Google Threat Intelligence Group (GTIG) publishes comprehensive analysis of Coruna iOS exploit kit, detailing 23 exploits across 5 chains targeting iOS 13-17.2.1, tracking proliferation from surveillance vendor to UNC6353 (Russia) to UNC6691 (China). [Source: https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit]
  • Google GTIG publishes comprehensive analysis of Coruna exploit kit; iVerify independently publishes CryptoWaters analysis
  • Kaspersky GReAT researcher Boris Larin disputes direct code reuse between Coruna and Operation Triangulation, stating both shared CVEs (Photon/CVE-2023-32434, Gallium/CVE-2023-38606) have publicly available implementations and could have been independently developed. [Source: https://www.theregister.com/2026/03/04/kaspersky_dismisses_claims_that_coruna/]
  • c/side publishes technical analysis of Coruna web delivery infrastructure, identifying 50+ delivery domains, 4-layer JavaScript obfuscation architecture, and DGA-generated .xyz C2 domains using ''lazarus'' seed string. [Source: https://cside.com/blog/inside-coruna-web-script-ios-exploit]
  • CISA adds CVE-2021-30952, CVE-2023-41974, and CVE-2023-43000 to Known Exploited Vulnerabilities (KEV) catalog with federal remediation deadline of March 26, 2026 under BOD 22-01. [Source: https://www.cisa.gov/news-events/alerts/2026/03/05/cisa-adds-five-known-exploited-vulnerabilities-catalog]
  • CISA adds CVE-2021-30952, CVE-2023-41974, CVE-2023-43000 to Known Exploited Vulnerabilities catalog with March 26 remediation deadline
  • TechCrunch reports two former L3Harris employees confirm ''Coruna'' as an internal Trenchant component name, with bird-themed codenames matching Trenchant''s ''Condor'' exploit naming convention, strengthening attribution to the U.S. military contractor. [Source: https://techcrunch.com/2026/03/09/an-iphone-hacking-toolkit-used-by-russian-spies-likely-came-from-u-s-military-contractor/]
  • Apple releases iOS 15.8.7, iPadOS 15.8.7, iOS 16.7.15, and iPadOS 16.7.15, backporting fixes for CVE-2023-41974, CVE-2024-23222, CVE-2023-43000, and CVE-2023-43010 to older devices that cannot upgrade to iOS 17+, explicitly confirming updates address ''kernel and WebKit vulnerabilities associated with the Coruna exploit.'' [Source: https://support.apple.com/en-us/126632]
  • As of 2026-05-29, the Coruna iOS exploit kit's 23 CVEs (iOS 13-17.2.1) are all patched by Apple, with iOS 17.3+ neutralizing the chains; three were added to CISA KEV on 2026-03-05 (BOD deadline 2026-03-26). The kit is ineffective against current iOS and its infrastructure has been taken down or rotated post-disclosure, confirming PATCHED.
  • Jamf Threat Labs publishes 'Why Fingerprinting Is the First Move in Mobile Attacks,' detailing Coruna's client-side 'Platform Detection Module' — a hidden-iframe HTML/JS component that parses the User-Agent to pick an exploit chain, and probes IndexedDB (private-browsing detection), WebRTC/WebGL absence, MathML render color, navigator.webdriver, and navigator.maxTouchPoints to detect restricted, automated, or researcher browser environments before firing.

Update history for TL-2026-0186

Sources cited for Coruna iOS Exploit Kit

Threats related to Coruna iOS Exploit Kit

Detection coverage for TL-2026-0186

As of 2026-08-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0186 across Splunk SPL, Microsoft KQL and Sigma, covering 39 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats