CorunaMalware
According to Google, this is a new and powerful exploit kit targeting Apple iPhone models running iOS version 13.0 (released in September 2019) up to version 17.2.1 (released in December 2023). The exploit kit, named "Coruna" by its developers, contained five full iOS exploit chains and a total of 23 exploits.From MISP Galaxy
Last reported 4 days ago, by The Hacker News5 reports
ATT&CK techniques
6 of 7 · each with the sentence it comes from- T1014Rootkit
“SIXZUT and JITTERLY: Newly launched security firm VirLabs looks at SIXZUT and JITTERLY, a Linux implant and a rootkit that are being planted by the Red Heron group on Gitea servers.”
- T1027.018Invisible Unicode
“Invisible Unicode characters: With the rise of AI email assistants, threat actors are going back to their bag of tricks from the early 2000s and we're seeing a rise in attacks leveraging invisible Unicode characters.”
- T1053.005Scheduled Task
“The phishing emails are delivering malicious archive files that use virtual hard disks to create scheduled tasks that periodically run the group's malware.”
- T1110.003Password Spraying
“The group, UNK_CondorFiltration, is using TeamFiltration, a tool to enumerate Entra ID accounts and launch password-spraying attacks.”
- T1176.001Browser Extensions
“Malicious browser extensions: Security researchers have discovered a cluster of more than 30 malicious Chrome extensions posing as financial advice tools.”
- T1213.005Messaging Applications
“Max analysis: Researchers at InterSecLab have published an in-depth analysis of Max, Russia's state-mandated messaging applications, and all the ways the app can spy on its users and what data it collects.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader“…with a report from Google Threat Intelligence Group (GTIG) in March 2026, which linked the Russian espionage actor UNC6353 to the use of Coruna and DarkSword kits in watering-hole campaigns targeting Ukrainian users since summer 2025.”
-
Risky Bulletin: Russia arrests DataSuckers hacking group“The Divine Seagull tool was built on top of Coruna and DarkSword, two professional iOS hacking tools that leaked this year.”
-
P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands“The disclosure comes as Censys said it identified open directories on five hosts carrying components related to DarkSword and Coruna, another iOS exploit kit uncovered this year as weaponized in attacks aimed at iPhone models running iOS versions between 13.0 and 17.2.1.”
-
Risky Bulletin: Sanctions force CAs to revoke TLS certs in Iran, Russia“The latest of these findings is from a suspected Chinese threat actor using the leaked Coruna iOS exploit kit.”
-
Risky Bulletin: Major vulnerability found in ancient TACACS+ networking protocol“"The module names, three-stage organisation, loader structure and associated administration panel link the sample to Coruna Pro V2, a codebase circulated publicly as a research toolkit and subsequently expanded with a management backend.”
Indicators in its reports
named in the reports above- kevincollier.bsky[.]socialin 2 reports
- third-party[.]comin 1 report
- 104.194.9[.]227in 1 report
- 166.88.95[.]90in 1 report
- raphae[.]liin 1 report
- verticalmailer[.]comin 1 report
- kevinhardiman.bsky[.]socialin 1 report
- 43.134.165[.]205in 1 report
- 183.154.173[.]30in 1 report
- 182.239.114[.]223in 1 report
- 23.148.212[.]237in 1 report
- 47.102.192[.]23in 1 report
- 156.239.230[.]120in 1 report
- 66ds[.]lolin 1 report
- 185.82.218[.]119in 1 report
- 91.149.221[.]118in 1 report
- 91.149.221[.]123in 1 report
- 166.88.239[.]54in 1 report
- 194.87.108[.]12in 1 report
- 194.87.108[.]217in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.