UNC6691
UNC6691 is a financially motivated threat actor assessed to operate from China. Google Threat Intelligence Group (GTIG) identified it as one of the actors using the Coruna iOS exploit kit (also referred to as CryptoWaters) and attributed to it broad-scale campaigns observed in late 2025. UNC6691 deployed Coruna through fake gambling, cryptocurrency, and other Chinese-language finance-themed websites, including clusters of fake Chinese sites that instructed users to visit from an iPhone or iPad and then delivered the exploit kit via hidden iframes. Unlike earlier more targeted Coruna activity, UNC6691 reportedly removed geographic restrictions and spread the kit broadly across more than 50 cryptocurrency scam and Chinese-language websites. The group’s activity is described as financially motivated rather than espionage-focused. GTIG reported that UNC6691 used a Coruna variant with a final payload customized for cryptocurrency theft. Delivered malware, including PlasmaLoader/PLASMAGRID, stole cryptocurrency wallet data from infected devices; reporting also states the payload harvested wallet information and seed phrases from cryptocurrency applications. Supporting reporting links UNC6691 infrastructure and campaigns to fake gambling and crypto lures, Chinese-language finance-themed watering holes, and broad exploitation of vulnerable iOS devices. Known alias in the provided content: unc6691.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they're from
Attributed origin per open-source reporting.
- CN
Tradecraft
35 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
3 malware families attributed to this actor across reporting.
Associated vulnerabilities
13 CVEs this actor has used in observed campaigns. 13 of them exploited in the wild.
iOS 16.6–17.2 ( JtEUci ) — Coruna cassowary (CVE-2024-23222, fixed 17.3)
iOS 16.2–16.5 ( KeCRDQ ) — Coruna terrorbird (CVE-2023-43000, fixed 16.6)
iOS 11.0–15.1 ( mmrZ0r ) — Coruna buffout (CVE-2021-30952, fixed 15.2) and jacurutu (CVE-2022-48503, fixed 15.6)
Stage 3 : Kernel privilege escalation through CVE-2023-32434, CVE-2023-38606, or CVE-2023-41974 achieves root and deploys the PLASMAGRID implant.
Stage 3 : Kernel privilege escalation through CVE-2023-32434, CVE-2023-38606, or CVE-2023-41974 achieves root and deploys the PLASMAGRID implant.
8 more CVEs tied to this actor tracked in Mallory.
Observables
183 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Assessed as the likely operator linked to this campaign using a Coruna-like iOS exploit delivery framework via a compromised npm package and watering-hole infrastructure, with deployment patterns aligned to bulk scam and Chinese-language website operations.
Using the proliferated Coruna iOS exploit kit and PLASMAGRID implant for financially motivated operations, including Chinese-language gambling watering holes and cryptocurrency wallet theft.
A Chinese financial threat actor observed using the Coruna iOS exploit kit in broad-scale attacks, illustrating reuse of advanced second-hand zero-day exploit capabilities.
Chinese threat cluster that modified Coruna by removing geographic restrictions and deploying it broadly via cryptocurrency scam sites for financial theft.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.