Two independent cybersecurity organizations — Google Threat Intelligence Group and iVerify — released reports on the same day describing a powerful iOS exploit kit known internally as Coruna.GTIG first discovered the threat in February 2025 and later uncovered its full scope after obtaining a developer debug build that revealed the internal names of its components. Around the same time, iVerify independently identified the same exploit kit and carried out its own detailed investigation over several weeks.

Both teams reached similar conclusions about the kit’s structure. Coruna includes 23 separate exploits organized into five exploit chains, targeting iOS versions 13 through 17.2.1. This coverage spans about four years of Apple software releases, suggesting the tool was actively developed and maintained over a long period rather than quickly assembled.

Each exploit chain is designed to carry out a full compromise process — starting with initial access and ending with full control of the device. Importantly, the chains are built with redundancy. If one exploit fails at a certain stage, another method can be used to continue the attack. This design greatly increases the chances of successfully compromising a device.

GTIG noted that Coruna’s sophistication comes from the use of non-public exploitation techniques and security bypass methods. In other words, the vulnerabilities and techniques used were not taken from publicly known research or proof-of-concept code. Creating such capabilities typically requires deep knowledge of Apple’s internal systems and access to undisclosed vulnerabilities — resources usually associated with well-funded government programs or specialized surveillance companies.

iVerify went further, describing Coruna as the first example of large-scale exploitation targeting iOS devices. According to the company, what appears to have started as a nation-state level tool has now moved into the hands of organized cybercriminal groups.

The exploit chain analyzed by iVerify includes two main stages.

  • The first stage is Remote Code Execution in Safari, which acts as the initial entry point. Safari is a logical target because Apple requires all iOS browsers to use its rendering engine, making it a common attack surface regardless of the browser a user installs.
  • The second stage involves Local Privilege Escalation, allowing the attacker to move from the restricted browser environment to full control of the device. This two-stage model is common in mobile exploitation, but executing it successfully against iOS is difficult because Apple continuously adds new security protections to the operating system. Both stages must function precisely and bypass multiple layers of defense.

A Timeline of Escalating Exposure

The known use of Coruna appears to involve two major operational phases, each involving different attackers and objectives.

The earliest confirmed use suggests the exploit kit was operated by a commercial surveillance vendor’s client, indicating that it may have originated within the grey market for offensive cyber tools sold to government agencies. This industry has faced heavy scrutiny in recent years following the exposure of surveillance platforms such as Pegasus spyware.

Coruna’s design reflects that environment. It shows signs of professional engineering, includes operational safeguards such as Lockdown Mode detection, and uses a modular architecture that can be adapted for different missions.

At some point, the tool was used by UNC6353, a suspected Russian state-linked espionage group. The group deployed the exploit kit in watering hole attacks aimed at Ukrainian users. This timing aligns with the broader increase in Russian cyber activity targeting Ukrainian institutions and civilians following the full-scale invasion of Ukraine in February 2022.

Watering hole attacks work by compromising websites that the intended victims regularly visit. Instead of directly targeting individuals, attackers infect trusted websites and wait for victims to visit them, turning normal browsing activity into the infection point. During this phase, the likely goal was intelligence collection rather than financial gain.

A second phase later emerged. By the time Coruna was being used by UNC6691, a financially motivated criminal group believed to operate from China, its purpose had shifted toward financial theft.

The surveillance-focused payloads that likely existed during earlier deployments were replaced with modules designed to target cryptocurrency wallets and financial credentials. This shift reflects a common trend in cybersecurity: powerful tools originally created for government operations eventually spread into criminal environments through resale, theft, or repurposing.

By late 2025, GTIG discovered Coruna’s JavaScript framework embedded inside fake Chinese websites. One example was a counterfeit WEEX cryptocurrency exchange page. The site was designed to redirect visitors who were not using iOS devices and encourage them to return with an iPhone or iPad.

This strategy serves two purposes. First, users visiting a cryptocurrency exchange are likely to possess digital assets. Second, when an iOS device visits the site, the exploit kit can be delivered silently through a hidden iFrame.

Through this infrastructure, GTIG was able to recover the complete set of obfuscated exploits and final payloads. The recovered debug version also exposed the internal naming scheme used by the developers.

During its own investigation, iVerify identified a suspicious domain — mxbc-v2[.]tjbjdod[.]cn — hosting a set of exploits. Researchers extracted a one-click exploit chain combining Safari remote code execution with a local privilege escalation vulnerability. Together, these exploits allow attackers to gain full control of the device.

Because the kit targeted cryptocurrency users and used watering hole tactics, iVerify initially named it CryptoWaters. The fake WEEX exchange site discovered by GTIG was likely one of these watering hole platforms. While early activity focused on Ukrainian targets, the campaign has since expanded to any iOS user who encounters the malicious infrastructure.

The broader story — a nation-state surveillance tool evolving into a large-scale criminal weapon within just a few years — highlights how quickly offensive cyber capabilities can spread once they leave their original environment.

The fact that two separate research teams discovered Coruna independently through unrelated investigations suggests that its deployment may now be widespread enough that encounters with its infrastructure are increasingly likely.

Defending Against Coruna

cybersecurity researcherProtection against Coruna is relatively simple.
The exploit kit does not work against iOS 17.3 or newer, meaning updating the device’s operating system provides the most effective protection.
For users who cannot update immediately, enabling Lockdown Mode offers additional defense. GTIG’s analysis revealed that Coruna actively checks whether Lockdown Mode is enabled and withdraws from the device if it detects it.

The exploit kit also avoids devices using private browsing mode, another sign that the developers intentionally built mechanisms to reduce the risk of detection or analysis. Interestingly, these same behaviors can help users avoid infection if they are aware of them.

Both GTIG and iVerify have stated that further technical details will be released as their investigations continue. At present, the most complete understanding of Coruna comes from combining insights from both reports.

References: