Threat reportMalwareTL-2026-3470
Coruna and DarkSword iOS Exploit Kits Compromise iPhones via Single Malicious Website (UNC6353, UNC6691, UNC6748, PARS Defense)
Coruna and DarkSword iOS Exploit Kits Compromise iPhones via (TL-2026-3470), also tracked as Coruna, is a high-severity malware campaign, first published 2026-10-14. It is attributed to UNC6353 (Russia) with medium confidence, affects Apple iOS / iPadOS (Coruna targets), references 18 CVEs (CVE-2020-27932, CVE-2020-27950, CVE-2021-30952), maps to 21 MITRE ATT&CK techniques (T1005, T1027, T1041), and is covered by 9 detection rules and 48 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 18Referenced vulnerabilities
- Techniques
- 21MITRE ATT&CK
- Actors
- 4UNC6353
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 48Indicators of compromise
Key facts for TL-2026-3470
- Threat ID
- TL-2026-3470
- Also known as
- Coruna, CryptoWaters, DarkSword, DarkCoruna, Darkuna, PlasmaLoader
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- UNC6353, UNC6691, UNC6748, PARS Defense
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- ESPIONAGE
- Target sectors
- government administration, finance, cryptocurrency, ecommerce, industrial, consumer
- Target regions
- ukraine, saudi arabia, turkey, malaysia, Global
- Detection rules
- 9
- Indicators of compromise
- 48
- Updates
- 2026-10-14 · revalidated 1× · latest source
Malware and tooling in Coruna and DarkSword iOS Exploit Kits Compromise iPhones via
Malware and tooling: Coruna, GHOSTBLADE, GHOSTKNIFE, GHOSTSABER, PlasmaLoader
How Coruna and DarkSword iOS Exploit Kits Compromise iPhones via works
Coruna (iOS 13.0-17.2.1; 5 chains, 23 exploits) and DarkSword (iOS 18.4-18.7; 6 CVEs) are web-delivered iOS exploit kits that fully compromise iPhones when a victim visits a compromised or fake website. They have been used by a suspected Russian espionage actor (UNC6353) against Ukrainian users, by commercial surveillance vendor customers, and by financially motivated actors (UNC6691) to steal cryptocurrency.
Coruna (aka CryptoWaters) was documented by Google Threat Intelligence Group (GTIG) on 2026-03-03. It contains five full iOS exploit chains and 23 exploits (WebContent read/write, PAC bypass, sandbox escape, kernel privilege escalation and PPL bypass stages) covering iOS 13.0 through 17.2.1, including several non-public exploits and mitigation bypasses. GTIG first saw parts of the kit in February 2025 in use by a customer of a commercial surveillance vendor, then in summer 2025 in watering-hole attacks on compromised Ukrainian websites (industrial equipment, retail, local services, e-commerce) attributed to UNC6353, a suspected Russian espionage group, and at the end of 2025 on a large set of fake Chinese-language crypto/gambling/finance sites operated by UNC6691, a financially motivated actor. Delivery is a hidden iframe on the compromised or fake site which loads a fingerprinting module; the kit selects the matching WebKit RCE, then a PAC bypass, a sandbox escape (IronLoader/NeuronLoader), a kernel LPE (Neutron, Dynamo, Pendulum, Photon, Parallax, Gruber) and a PPL bypass (Quark, Gallium, Carbone, Sparrow, Rocket). The framework bails out if Lockdown Mode or private browsing is detected, uses XOR/map-join string obfuscation and derives resource URLs as sha256(cookie+id)[:40]. The final implant, PlasmaLoader (PLASMAGRID, bundle ID com.apple.assistd), injects into the root daemon powerd, decodes QR codes and searches files for BIP39 seed phrases and keywords such as 'backup phrase' and 'bank account', and downloads per-wallet modules (MetaMask, Exodus, Phantom, Trust, Uniswap and others). C2 uses HTTPS with AES, custom headers (sdkv, x-ts), and a DGA seeded with 'lazarus' producing 15-character .xyz domains validated via 8.8.8.8. Press reports suggest the kit may derive from a Western commercial offensive tool; this is unverified.
DarkSword was disclosed on 2026-03-18 by GTIG, iVerify and Lookout. It targets iOS 18.4 through 18.7 and has been in use since at least November 2025. The chain uses six vulnerabilities: CVE-2025-31277 and CVE-2025-43529 (JavaScriptCore RCE), CVE-2026-20700 (dyld user-mode PAC bypass), CVE-2025-14174 (ANGLE, WebContent to GPU process escape), CVE-2025-43510 (XNU copy-on-write, GPU process to mediaplaybackd) and CVE-2025-43520 (XNU VFS race, kernel LPE). Delivery is again a hidden iframe from watering-hole pages. Three JavaScript payloads were observed: GHOSTKNIFE (UNC6748, Saudi Arabia, Snapchat-themed snapshare.chat; custom binary protocol over HTTP with ECDH+AES; account, message, browser, location, audio and screenshot theft; deletes crash logs), GHOSTSABER (PARS Defense, Turkey and Malaysia; HTTP(S) backdoor with SQLite query, file exfiltration and EvalJs), and GHOSTBLADE (UNC6353, Ukraine, December 2025-March 2026; data miner for iMessage, Telegram, WhatsApp, keychain, Wi-Fi passwords, photos, Health, Safari data and crypto wallets, deleting DiagnosticReports afterwards). The same suspected Russian actor UNC6353 has used both kits. DarkSword source code subsequently appeared publicly, and iVerify reported hybrid variants (informally 'Darkuna'/DarkCoruna), ~17,000 domains hosting second-generation iterations, and, per the October 2026 GBHackers report, September 2026 telemetry showing Coruna on about 5% of measured devices (up from 1.5% in August). Apple has patched all DarkSword CVEs (latest fixes in iOS 26.3 / 18.7.x); GTIG states Coruna is ineffective on current iOS. CISA added Coruna- and DarkSword-related Apple flaws to the KEV catalog.
MITRE ATT&CK techniques used in TL-2026-3470
Collection
T1005 Data from Local System; T1113 Screen Capture; T1123 Audio Capture
Defense Evasion
T1027 Obfuscated Files or Information; T1055 Process Injection; T1070.004 Indicator Removal: File Deletion
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059.007 Command and Scripting Interpreter: JavaScript; T1203 Exploitation for Client Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer; T1568.002 Dynamic Resolution: Domain Generation Algorithms; T1573 Encrypted Channel
Discovery
T1082 System Information Discovery
Initial Access
Credential Access
T1555 Credentials from Password Stores; T1555.001 Credentials from Password Stores: Keychain
Reconnaissance
T1592 Gather Victim Host Information
Resource Development
Impact
Affected products and versions in Coruna and DarkSword iOS Exploit Kits Compromise iPhones via
Remediation for Coruna and DarkSword iOS Exploit Kits Compromise iPhones via
Patches
- CVE-2025-31277 fixed in iOS 18.6
- CVE-2025-43510 and CVE-2025-43520 fixed in iOS 18.7.2 / 26.1
- CVE-2025-43529 and CVE-2025-14174 fixed in iOS 18.7.3 / 26.2
- CVE-2026-20700 fixed in iOS 26.3
Immediate actions
- Update all iPhones/iPads to the latest iOS (iOS 26.3 or later; GTIG states Coruna is ineffective on current iOS)
- Enable Apple Lockdown Mode for high-risk users; Coruna bails out when Lockdown Mode is detected
- Block and hunt for the listed domains, URLs and IPs in DNS, proxy and firewall logs
- Review mobile EDR/MDM telemetry for devices running iOS 13.0-17.2.1 and 18.4-18.7 that visited the listed domains
Workarounds
- Lockdown Mode on devices that cannot be updated immediately
- Avoid untrusted or compromised websites; disable JavaScript-heavy browsing for high-risk users where feasible
Longer-term hardening
- Deploy mobile EDR/MTD with iOS telemetry and enforce minimum OS version via MDM
- Retire devices that cannot update past vulnerable iOS versions
- Hunt for GTIG YARA indicators (GHOSTKNIFE, GHOSTSABER, GHOSTBLADE, PLASMAGRID) in collected device artifacts
- Train high-risk staff on watering-hole and fake finance/crypto site risks
CVEs associated with Coruna and DarkSword iOS Exploit Kits Compromise iPhones via
Timeline of Coruna and DarkSword iOS Exploit Kits Compromise iPhones via
- GTIG captures parts of an iOS exploit chain (later identified as Coruna) used by a customer of a commercial surveillance vendor (February 2025; day approximate).
- UNC6353, a suspected Russian espionage group, delivers Coruna via watering holes on compromised Ukrainian websites (summer 2025; day approximate).
- DarkSword in use since at least early November 2025; UNC6748 targets Saudi Arabian users via snapshare.chat and PARS Defense begins Turkey campaigns (day approximate).
- UNC6691 deploys Coruna on a large set of fake Chinese-language crypto/finance sites; UNC6353 begins DarkSword delivery from static.cdncounter.net in Ukraine (day approximate).
- PARS Defense campaign against Malaysian users via e5.malaymoil.com delivering GHOSTSABER (January 2026; day approximate).
- Apple patches CVE-2026-20700 (dyld PAC/TPRO bypass), a DarkSword zero-day.
- GTIG publishes the Coruna analysis: five exploit chains, 23 exploits, iOS 13.0-17.2.1, PlasmaLoader implant.
- CISA adds Coruna-related Apple vulnerabilities to the Known Exploited Vulnerabilities catalog (per The Hacker News).
- Apple releases security updates for older iOS branches (iOS 15-16) addressing Coruna-related flaws.
- GTIG, iVerify and Lookout publish DarkSword: six CVEs, iOS 18.4-18.7, GHOSTKNIFE/GHOSTSABER/GHOSTBLADE payloads.
- iVerify discovers the P7 DarkSword variant with improved stealth, keychain extraction and bidirectional C2 (month-level date).
- iVerify September 2026 telemetry reports Coruna on about 5% of measured devices, up from 1.5% in August, with hybrid DarkCoruna variants and public DarkSword source code (month-level date).
- iVerify publishes P7 DarkSword research with IOCs (agdx53.cc C2, gotoiphone.com and mzpo30.cam delivery).
- GBHackers reports both kits can compromise iPhones through a single malicious website, with live and historic attacks documented.
Update history for TL-2026-3470
- 2026-10-14 — Coruna and DarkSword iOS Exploit Kits Enable Full iPhone Compromise via Single Web Visit (UNC6353, UNC6691, PARS Defense): What changed No field escalations applied. The report rates severity CRITICAL, but the only new evidence is a stealthier DarkSword variant against already-patched flaws, so severity stays HIGH. Exploitability is already ACTIVE. New indicato
Sources cited for Coruna and DarkSword iOS Exploit Kits Compromise iPhones via
- Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit (GTIG)
- DarkSword iOS Exploit Chain (GTIG)
- Coruna iOS Exploit Kit Uses 23 Exploits (The Hacker News)
- DarkSword exploit kit steals iPhone data (The Register)
- DarkSword: Researchers uncover another iOS exploit kit (Help Net Security)
- Second iOS exploit kit emerges from suspected Russian hackers (CyberScoop)
- CISA orders feds to patch DarkSword iOS flaws exploited in attacks (BleepingComputer)
- Mass Scale Mobile Exploitation and the Enterprise Detection Gap (iVerify)
- Coruna Executive Summary (iVerify)
- Coruna, DarkSword iOS Exploits Proliferate Globally (Dark Reading)
- iOS Exploit Kits Can Compromise iPhones Through a Single Malicious Website (GBHackers)
Detection coverage for TL-2026-3470
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3470 across Splunk SPL, Microsoft KQL and Sigma, covering 48 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.