# Coruna Exploit Framework — Updated Operation Triangulation iOS Exploit Kit (CVE-2023-32434, CVE-2023-38606)

> Kaspersky GReAT reveals the Coruna exploit framework, an updated version of the iOS exploit kit used in Operation Triangulation. The framework contains five kernel exploits — updated versions of CVE-2023-32434 and CVE-2023-38606 plus four previously unobserved exploits — targeting Apple A13 through A17 and M3 chips via watering-hole attacks and surveillance vendor delivery.

- **Published:** 2026-03-26T12:00:00Z
- **Last reviewed:** 2026-03-26T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0286
- **ID:** TL-2026-0286
- **Severity:** CRITICAL (CVSS 8.8)
- **Category:** ZERO_DAY
- **Status:** ACTIVE
- **Actor:** Operation Triangulation Operator (Russia)
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2023-32434, CVE-2023-38606, CVE-2023-41990, CVE-2023-32435

## Description

The Coruna exploit framework is a sophisticated, modular iOS exploitation platform revealed by Kaspersky's Global Research and Analysis Team (GReAT) on March 26, 2026. It represents an evolution of the exploit chain originally discovered during the Operation Triangulation investigation, which targeted iOS devices through zero-click iMessage exploitation beginning as early as 2019.

Coruna packages five kernel exploits into a single framework with architecture-aware payload selection. Two of these exploits are updated versions of the CVE-2023-32434 (integer overflow in XNU memory mapping syscalls) and CVE-2023-38606 (undocumented hardware MMIO register abuse for kernel memory protection bypass) vulnerabilities previously documented in Operation Triangulation. The remaining four kernel exploits are previously unobserved and target a range of iOS versions from pre-14.0 beta 7 through pre-17.2.

The attack chain begins with a Safari stager component that fingerprints the target browser and selects appropriate remote code execution (RCE) and Pointer Authentication Code (PAC) exploits based on the browser version. An encrypted component manifest is then downloaded, containing information about all available exploit packages. Multi-stage decryption uses ChaCha20 stream cipher with 256-bit keys followed by LZMA decompression. The framework uses distinctive magic numbers: 0xBEDF00D for LZMA-compressed containers, 0xF00DBEEF for file storage containers, 0x12345678 for package information format, and 0xDEADD00F for launcher configuration.

Package selection is architecture and version-specific: package IDs 0xF2/0xF3 correspond to ARM64/ARM64E kernel exploits, 0xA2/0xA3 to Mach-O loaders, and the range 0xF3300000-0xF3900000 to iOS version-specific exploit variants. File IDs within packages include 0x10000 (implant), 0x50000 (Mach-O loader), 0x70000 (component list), 0x90000 (kernel exploit), and 0xA0000 (logs cleaner).

The CVE-2023-38606 exploit is particularly notable as it abuses undocumented Apple hardware MMIO registers at addresses 0x206040000, 0x206140000, and 0x206150000 on A12-A16 Bionic SoCs to bypass the Page Protection Layer (PPL). These registers interact with the GPU coprocessor subsystem and were not documented in any public specification, device tree firmware, or source code — raising significant questions about how the attackers discovered them.

Post-exploitation capabilities include process injection via a Mach-O loader, a launcher component for orchestrating implant deployment, kernel memory read/write through exploit-created kernel objects, and an artifact removal component that cleans logs and forensic traces. The framework supports configurable target process names for injection.

Delivery has been observed through three distinct channels: watering-hole attacks targeting Ukrainian entities, financially motivated attacks in China, and distribution through an unnamed surveillance vendor's customer operations. Google Threat Intelligence and iVerify published related reports on March 4, 2026, followed by Kaspersky's full framework analysis on March 26, 2026.

The original Operation Triangulation campaign used an 11,000-line obfuscated JavaScript exploit delivered via zero-click iMessage attachments, exploiting CVE-2023-41990 (TrueType font instruction vulnerability), CVE-2023-32434, CVE-2023-38606, and CVE-2023-32435 in sequence. The Coruna framework represents a significant evolution — packaging updated exploits with broader chip support (A13 through A17, M3/M3 Pro/M3 Max), multi-architecture awareness, and encrypted modular delivery.

## MITRE ATT&CK

- T1189 Drive-by Compromise
- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1106 Native API
- T1547 Boot or Logon Autostart Execution
- T1068 Exploitation for Privilege Escalation
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1055 Process Injection
- T1553 Subvert Trust Controls
- T1003 OS Credential Dumping
- T1082 System Information Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1573 Encrypted Channel
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1587 Develop Capabilities
- T1588 Obtain Capabilities

## Sources

- [Kaspersky GReAT: Coruna — the framework used in Operation Triangulation](https://securelist.com/coruna-framework-updated-operation-triangulation-exploit/119228/)
- [Kaspersky: Operation Triangulation — The Last (Hardware) Mystery](https://securelist.com/operation-triangulation-the-last-hardware-mystery/111669/)
- [Kaspersky: Operation Triangulation Initial Discovery](https://securelist.com/operation-triangulation/109842/)
- [Apple Security Advisory HT213808 — iOS 16.5.1 and iPadOS 16.5.1](https://support.apple.com/en-us/HT213808)
- [Apple Security Advisory HT213814 — macOS Ventura 13.4.1](https://support.apple.com/en-us/HT213814)
- [NVD — CVE-2023-32434 Integer Overflow in Apple XNU](https://nvd.nist.gov/vuln/detail/CVE-2023-32434)
- [NVD — CVE-2023-38606 Kernel State Modification](https://nvd.nist.gov/vuln/detail/CVE-2023-38606)
- [CISA KEV — CVE-2023-32434 Known Exploited Vulnerability](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [MITRE ATT&CK Campaign C0054 — Operation Triangulation](https://attack.mitre.org/campaigns/C0054/)
- [37C3 Presentation: Operation Triangulation — What You Get When Attack iPhones of Researchers](https://media.ccc.de/v/37c3-11859-operation_triangulation_what_you_get_when_attack_iphones_of_researchers)
- [Google Threat Intelligence Report on Coruna-related Exploits](https://blog.google/threat-analysis-group/)
- [iVerify Research on Coruna-related iOS Exploitation](https://iverify.io/blog)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0286