Coruna Exploit Framework — Updated Operation Triangulation iOS Exploit Kit (CVE-2023-32434, CVE-2023-38606)
Coruna Exploit Framework (TL-2026-0286), also tracked as Operation Triangulation, is a critical-severity zero-day vulnerability scored CVSS 8.8, first published 2026-03-26. It is attributed to Operation Triangulation Operator (Russia) with medium confidence, affects Apple iOS, references 4 CVEs (CVE-2023-32434, CVE-2023-38606, CVE-2023-41990), maps to 20 MITRE ATT&CK techniques (T1003, T1005, T1027), and is covered by 9 detection rules and 26 indicators of compromise.
Key facts for TL-2026-0286
- Threat ID
- TL-2026-0286
- Also known as
- Operation Triangulation, Coruna Framework, MITRE C0054
- Severity
- CRITICAL
- CVSS
- 8.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- ZERO_DAY
- First published
- 2026-03-26
- Last reviewed
- 2026-03-26
- Attribution
- Operation Triangulation Operator
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- ESPIONAGE
- Target sectors
- government, defense, technology, telecommunications, research, financial, critical-infrastructure
- Target regions
- Eastern Europe, Ukraine, China, Global
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in Coruna Exploit Framework
Malware and tooling: Coruna
Kaspersky GReAT reveals the Coruna exploit framework, an updated version of the iOS exploit kit used in Operation Triangulation. The framework contains five kernel exploits — updated versions of CVE-2023-32434 and CVE-2023-38606 plus four previously unobserved exploits — targeting Apple A13 through A17 and M3 chips via watering-hole attacks and surveillance vendor delivery.
How Coruna Exploit Framework works
The Coruna exploit framework is a sophisticated, modular iOS exploitation platform revealed by Kaspersky's Global Research and Analysis Team (GReAT) on March 26, 2026. It represents an evolution of the exploit chain originally discovered during the Operation Triangulation investigation, which targeted iOS devices through zero-click iMessage exploitation beginning as early as 2019.
Coruna packages five kernel exploits into a single framework with architecture-aware payload selection. Two of these exploits are updated versions of the CVE-2023-32434 (integer overflow in XNU memory mapping syscalls) and CVE-2023-38606 (undocumented hardware MMIO register abuse for kernel memory protection bypass) vulnerabilities previously documented in Operation Triangulation. The remaining four kernel exploits are previously unobserved and target a range of iOS versions from pre-14.0 beta 7 through pre-17.2.
The attack chain begins with a Safari stager component that fingerprints the target browser and selects appropriate remote code execution (RCE) and Pointer Authentication Code (PAC) exploits based on the browser version. An encrypted component manifest is then downloaded, containing information about all available exploit packages. Multi-stage decryption uses ChaCha20 stream cipher with 256-bit keys followed by LZMA decompression. The framework uses distinctive magic numbers: 0xBEDF00D for LZMA-compressed containers, 0xF00DBEEF for file storage containers, 0x12345678 for package information format, and 0xDEADD00F for launcher configuration.
Package selection is architecture and version-specific: package IDs 0xF2/0xF3 correspond to ARM64/ARM64E kernel exploits, 0xA2/0xA3 to Mach-O loaders, and the range 0xF3300000-0xF3900000 to iOS version-specific exploit variants. File IDs within packages include 0x10000 (implant), 0x50000 (Mach-O loader), 0x70000 (component list), 0x90000 (kernel exploit), and 0xA0000 (logs cleaner).
The CVE-2023-38606 exploit is particularly notable as it abuses undocumented Apple hardware MMIO registers at addresses 0x206040000, 0x206140000, and 0x206150000 on A12-A16 Bionic SoCs to bypass the Page Protection Layer (PPL). These registers interact with the GPU coprocessor subsystem and were not documented in any public specification, device tree firmware, or source code — raising significant questions about how the attackers discovered them.
Post-exploitation capabilities include process injection via a Mach-O loader, a launcher component for orchestrating implant deployment, kernel memory read/write through exploit-created kernel objects, and an artifact removal component that cleans logs and forensic traces. The framework supports configurable target process names for injection.
Delivery has been observed through three distinct channels: watering-hole attacks targeting Ukrainian entities, financially motivated attacks in China, and distribution through an unnamed surveillance vendor's customer operations. Google Threat Intelligence and iVerify published related reports on March 4, 2026, followed by Kaspersky's full framework analysis on March 26, 2026.
The original Operation Triangulation campaign used an 11,000-line obfuscated JavaScript exploit delivered via zero-click iMessage attachments, exploiting CVE-2023-41990 (TrueType font instruction vulnerability), CVE-2023-32434, CVE-2023-38606, and CVE-2023-32435 in sequence. The Coruna framework represents a significant evolution — packaging updated exploits with broader chip support (A13 through A17, M3/M3 Pro/M3 Max), multi-architecture awareness, and encrypted modular delivery.
MITRE ATT&CK techniques used in TL-2026-0286
credential-access
collection
defense-evasion
T1027 Obfuscated Files or Information; T1055 Process Injection; T1070 Indicator Removal
exfiltration
T1041 Exfiltration Over C2 Channel
privilege-escalation
T1068 Exploitation for Privilege Escalation
command-and-control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1573 Encrypted Channel
discovery
T1082 System Information Discovery; T1518 Software Discovery
execution
T1106 Native API; T1203 Exploitation for Client Execution
initial-access
T1189 Drive-by Compromise; T1190 Exploit Public-Facing Application
persistence
T1547 Boot or Logon Autostart Execution
defense-impairment
resource-development
Affected products and versions in Coruna Exploit Framework
- Apple — iOS
Vulnerable versions: < 14.0 beta 7; 14.0 - 14.7; 15.0 - 15.7.7; 16.0 - 16.5; 16.5 - 16.6 beta 4; 16.6 beta 5 - 17.1
Fixed in: 17.2 and later - Apple — iPadOS
Vulnerable versions: < 15.7.8; 16.0 - 16.5
Fixed in: 15.7.8; 16.6 and later - Apple — macOS Ventura
Vulnerable versions: < 13.4.1 (CVE-2023-32434); < 13.5 (CVE-2023-38606)
Fixed in: 13.5 and later - Apple — macOS Monterey
Vulnerable versions: < 12.6.7 (CVE-2023-32434); < 12.6.8 (CVE-2023-38606)
Fixed in: 12.6.8 and later - Apple — macOS Big Sur
Vulnerable versions: < 11.7.8 (CVE-2023-32434); < 11.7.9 (CVE-2023-38606)
Fixed in: 11.7.9 and later - Apple — watchOS
Vulnerable versions: < 8.8.1; 9.0 - 9.5.1 (CVE-2023-32434); < 9.6 (CVE-2023-38606)
Fixed in: 9.6 and later - Apple — tvOS
Vulnerable versions: < 16.6
Fixed in: 16.6 and later
Remediation for Coruna Exploit Framework
Patches
- iOS 17.2 / iPadOS 17.2 — patches all Coruna-targeted vulnerabilities
- iOS 16.6 beta 5 — partial mitigation for CVE-2023-32434
- iOS 16.5 beta 4 — partial mitigation for earlier exploit variants
- macOS Ventura 13.4.1 / 13.5 — patches CVE-2023-32434 and CVE-2023-38606
- macOS Monterey 12.6.7 / 12.6.8 — patches CVE-2023-32434 and CVE-2023-38606
- macOS Big Sur 11.7.8 / 11.7.9 — patches CVE-2023-32434 and CVE-2023-38606
- watchOS 8.8.1 / 9.5.1 / 9.6 — patches CVE-2023-32434 and CVE-2023-38606
Immediate actions
- Update all iOS devices to iOS 17.2 or later immediately
- Update macOS to Ventura 13.5 or later, Monterey 12.6.8 or later, Big Sur 11.7.9 or later
- Update watchOS to 9.6 or later
- Enable Lockdown Mode on high-value iOS/macOS targets
- Monitor for anomalous BackupAgent process activity in device usage logs
- Block known Operation Triangulation C2 domains at DNS/firewall level
Workarounds
- Enable Lockdown Mode on all iOS/macOS devices to restrict browser and iMessage attack surface
- Restrict Safari usage on sensitive devices — use managed browser with URL filtering
- Disable iMessage on high-value targets if not operationally required
- Implement DNS sinkholing for known Operation Triangulation C2 domains
Longer-term hardening
- Deploy MDM solution with continuous iOS version compliance monitoring
- Implement network monitoring for encrypted callback patterns to unknown infrastructure
- Deploy endpoint detection capable of identifying Mach-O injection on iOS
- Establish mobile threat defense (MTD) solution for fleet-wide iOS monitoring
- Conduct forensic analysis of any devices running iOS < 17.2 that accessed untrusted websites
CVEs associated with Coruna Exploit Framework
CVE-2023-32434, CVE-2023-38606, CVE-2023-41990, CVE-2023-32435
Weaknesses (CWE) in Coruna Exploit Framework
CWE-190, CWE-269, CWE-119, CWE-787
Timeline of Coruna Exploit Framework
- Oldest traces of Operation Triangulation activity identified by Kaspersky during forensic analysis of corporate network
- Kaspersky publicly discloses Operation Triangulation zero-click iMessage exploit campaign targeting iOS devices
- Apple releases iOS 16.5.1, macOS Ventura 13.4.1, and other updates patching CVE-2023-32434 integer overflow vulnerability
- CISA adds CVE-2023-32434 to Known Exploited Vulnerabilities catalog with action due date July 14, 2023
- Apple releases iOS 16.6, macOS Ventura 13.5, and other updates patching CVE-2023-38606 kernel state modification vulnerability
- CISA adds CVE-2023-38606 to Known Exploited Vulnerabilities catalog with action due date August 16, 2023
- Apple releases iOS 17.2 — the latest iOS version at time of Coruna framework development, which mitigates all five kernel exploits
- Kaspersky GReAT presents Operation Triangulation hardware mystery at 37th Chaos Communication Congress, revealing CVE-2023-38606 MMIO register exploit
- MITRE ATT&CK registers Operation Triangulation as campaign C0054
- Google Threat Intelligence and iVerify publish independent reports on Coruna-related iOS exploitation activity
- Kaspersky GReAT publishes full technical analysis of the Coruna exploit framework, revealing five kernel exploits including four previously unobserved
- As of 2026-05-29, the Coruna framework remains a live, continuously-maintained threat actively exploited in 2026 against out-of-date iPhones (Ukraine watering-holes, ~42k-device Chinese mass campaign), per Kaspersky/Google/iVerify. Its 2023 CVEs are patched in iOS 17.2 with Apple backporting fixes to legacy iOS 15.8.7/16.7.15 on 2026-03-11, but unpatched devices stay at risk.
Sources cited for Coruna Exploit Framework
- Kaspersky GReAT: Coruna — the framework used in Operation Triangulation
- Kaspersky: Operation Triangulation — The Last (Hardware) Mystery
- Kaspersky: Operation Triangulation Initial Discovery
- Apple Security Advisory HT213808 — iOS 16.5.1 and iPadOS 16.5.1
- Apple Security Advisory HT213814 — macOS Ventura 13.4.1
- NVD — CVE-2023-32434 Integer Overflow in Apple XNU
- NVD — CVE-2023-38606 Kernel State Modification
- CISA KEV — CVE-2023-32434 Known Exploited Vulnerability
- CISA KEV — CVE-2023-38606 Known Exploited Vulnerability
- MITRE ATT&CK Campaign C0054 — Operation Triangulation
- 37C3 Presentation: Operation Triangulation — What You Get When Attack iPhones of Researchers
- Google Threat Intelligence Report on Coruna-related Exploits
- iVerify Research on Coruna-related iOS Exploitation
Threats related to Coruna Exploit Framework
- Coruna iOS Exploit Kit — 23 Exploits Across 5 Chains Targeting iOS 13-17.2.1 (CVE-2021-30952, CVE-2023-41974, CVE-2023-43000 + 20 More)
- Coruna iOS Exploit Kit — Government-Grade 23-Exploit Arsenal Proliferates from Surveillance Vendor to Russian Espionage and Chinese Cybercriminals Targeting 42K+ Devices
- DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors (CVE-2026-20700, CVE-2025-43529, CVE-2025-31277)
Detection coverage for TL-2026-0286
As of 2026-03-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0286 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.