# Coruna and DarkSword iOS Exploit Kits Compromise iPhones via Single Malicious Website (UNC6353, UNC6691, UNC6748, PARS Defense)

> Coruna (iOS 13.0-17.2.1; 5 chains, 23 exploits) and DarkSword (iOS 18.4-18.7; 6 CVEs) are web-delivered iOS exploit kits that fully compromise iPhones when a victim visits a compromised or fake website. They have been used by a suspected Russian espionage actor (UNC6353) against Ukrainian users, by commercial surveillance vendor customers, and by financially motivated actors (UNC6691) to steal cryptocurrency.

- **Published:** 2026-10-14T05:57:37Z
- **Last reviewed:** 2026-10-14T09:38:24.096Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3470
- **ID:** TL-2026-3470
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** UNC6353 (Russia)
- **Detections:** 9 · **IOCs:** 48 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2020-27932, CVE-2020-27950, CVE-2021-30952, CVE-2022-48503, CVE-2023-32409, CVE-2023-32434, CVE-2023-38606, CVE-2023-41974, CVE-2023-43000, CVE-2024-23222, CVE-2024-23225, CVE-2024-23296, CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520

## Description

Coruna (aka CryptoWaters) was documented by Google Threat Intelligence Group (GTIG) on 2026-03-03. It contains five full iOS exploit chains and 23 exploits (WebContent read/write, PAC bypass, sandbox escape, kernel privilege escalation and PPL bypass stages) covering iOS 13.0 through 17.2.1, including several non-public exploits and mitigation bypasses. GTIG first saw parts of the kit in February 2025 in use by a customer of a commercial surveillance vendor, then in summer 2025 in watering-hole attacks on compromised Ukrainian websites (industrial equipment, retail, local services, e-commerce) attributed to UNC6353, a suspected Russian espionage group, and at the end of 2025 on a large set of fake Chinese-language crypto/gambling/finance sites operated by UNC6691, a financially motivated actor. Delivery is a hidden iframe on the compromised or fake site which loads a fingerprinting module; the kit selects the matching WebKit RCE, then a PAC bypass, a sandbox escape (IronLoader/NeuronLoader), a kernel LPE (Neutron, Dynamo, Pendulum, Photon, Parallax, Gruber) and a PPL bypass (Quark, Gallium, Carbone, Sparrow, Rocket). The framework bails out if Lockdown Mode or private browsing is detected, uses XOR/map-join string obfuscation and derives resource URLs as sha256(cookie+id)[:40]. The final implant, PlasmaLoader (PLASMAGRID, bundle ID com.apple.assistd), injects into the root daemon powerd, decodes QR codes and searches files for BIP39 seed phrases and keywords such as 'backup phrase' and 'bank account', and downloads per-wallet modules (MetaMask, Exodus, Phantom, Trust, Uniswap and others). C2 uses HTTPS with AES, custom headers (sdkv, x-ts), and a DGA seeded with 'lazarus' producing 15-character .xyz domains validated via 8.8.8.8. Press reports suggest the kit may derive from a Western commercial offensive tool; this is unverified.

DarkSword was disclosed on 2026-03-18 by GTIG, iVerify and Lookout. It targets iOS 18.4 through 18.7 and has been in use since at least November 2025. The chain uses six vulnerabilities: CVE-2025-31277 and CVE-2025-43529 (JavaScriptCore RCE), CVE-2026-20700 (dyld user-mode PAC bypass), CVE-2025-14174 (ANGLE, WebContent to GPU process escape), CVE-2025-43510 (XNU copy-on-write, GPU process to mediaplaybackd) and CVE-2025-43520 (XNU VFS race, kernel LPE). Delivery is again a hidden iframe from watering-hole pages. Three JavaScript payloads were observed: GHOSTKNIFE (UNC6748, Saudi Arabia, Snapchat-themed snapshare.chat; custom binary protocol over HTTP with ECDH+AES; account, message, browser, location, audio and screenshot theft; deletes crash logs), GHOSTSABER (PARS Defense, Turkey and Malaysia; HTTP(S) backdoor with SQLite query, file exfiltration and EvalJs), and GHOSTBLADE (UNC6353, Ukraine, December 2025-March 2026; data miner for iMessage, Telegram, WhatsApp, keychain, Wi-Fi passwords, photos, Health, Safari data and crypto wallets, deleting DiagnosticReports afterwards). The same suspected Russian actor UNC6353 has used both kits. DarkSword source code subsequently appeared publicly, and iVerify reported hybrid variants (informally 'Darkuna'/DarkCoruna), ~17,000 domains hosting second-generation iterations, and, per the October 2026 GBHackers report, September 2026 telemetry showing Coruna on about 5% of measured devices (up from 1.5% in August). Apple has patched all DarkSword CVEs (latest fixes in iOS 26.3 / 18.7.x); GTIG states Coruna is ineffective on current iOS. CISA added Coruna- and DarkSword-related Apple flaws to the KEV catalog.

## MITRE ATT&CK

- T1592 Gather Victim Host Information
- T1608 Stage Capabilities
- T1203 Exploitation for Client Execution
- T1055 Process Injection
- T1027 Obfuscated Files or Information
- T1070.004 Indicator Removal: File Deletion
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1005 Data from Local System
- T1071.001 Application Layer Protocol: Web Protocols
- T1573 Encrypted Channel
- T1568.002 Dynamic Resolution: Domain Generation Algorithms
- T1189 Drive-by Compromise
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1068 Exploitation for Privilege Escalation
- T1555.001 Credentials from Password Stores: Keychain
- T1113 Screen Capture
- T1123 Audio Capture
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Sources

- [Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit (GTIG)](https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit)
- [DarkSword iOS Exploit Chain (GTIG)](https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain)
- [Coruna iOS Exploit Kit Uses 23 Exploits (The Hacker News)](https://thehackernews.com/2026/03/coruna-ios-exploit-kit-uses-23-exploits.html)
- [DarkSword exploit kit steals iPhone data (The Register)](https://theregister.com/2026/03/18/darksword_exploit_kit_steals_iphone)
- [DarkSword: Researchers uncover another iOS exploit kit (Help Net Security)](https://www.helpnetsecurity.com/2026/03/19/darksword-ios-exploit-iphone/)
- [Second iOS exploit kit emerges from suspected Russian hackers (CyberScoop)](https://cyberscoop.com/second-ios-exploit-kit-emerges/)
- [CISA orders feds to patch DarkSword iOS flaws exploited in attacks (BleepingComputer)](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-darksword-ios-flaws-exploited-attacks/)
- [Mass Scale Mobile Exploitation and the Enterprise Detection Gap (iVerify)](https://learn.iverify.io/hubfs/Executive-Overviews/Mass-Scale-Mobile-Exploitation-and-the-Enterprise-Detection-Gap.pdf)
- [Coruna Executive Summary (iVerify)](https://learn.iverify.io/hubfs/Executive-Overviews/Coruna-Executive-Summary.pdf)
- [Coruna, DarkSword iOS Exploits Proliferate Globally (Dark Reading)](https://www.darkreading.com/vulnerabilities-threats/coruna-darksword-ios-exploits-proliferate-globally)
- [iOS Exploit Kits Can Compromise iPhones Through a Single Malicious Website (GBHackers)](https://gbhackers.com/ios-exploit-kits/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3470