Photon
Photon is an internal exploit name associated with the Coruna iOS exploit framework and previously linked to Operation Triangulation. Reporting states that Coruna reused Photon and Gallium as zero-day exploits in Triangulation, and Google researchers said these names were used by the original developers. Photon has been linked by researchers to CVE-2023-32434, described as a privilege-escalation vulnerability involving an integer overflow in memory mapping, affecting iOS 14.5 through 15.7.6. In the broader Coruna framework, Photon was part of tooling used to compromise Apple iPhones across iOS 13 through 17.2.1, alongside WebKit exploitation, sandbox escape, privilege escalation, and Page Protection Layer bypass techniques. Coruna was reportedly used in 2025 across multiple actor ecosystems: initially in highly targeted operations, then by the Russian espionage cluster UNC6353 in watering-hole attacks against Ukrainian iPhone users via compromised Ukrainian websites and geofenced delivery, and later by the China-linked financially motivated cluster UNC6691 in fraudulent cryptocurrency and financial-site campaigns. Supporting reporting also notes alleged links between Coruna and L3Harris Trenchant-origin tooling, but attribution remains cautious; Kaspersky stated that shared use of Photon and Gallium alone is insufficient to attribute Operation Triangulation to a specific actor or exploit developer because vulnerability details later became public.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Coruna reused two major internal exploits, Photon and Gallium, which were deployed as zero-day vulnerabilities in the Triangulation attacks.
Techniques & procedures
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An internal exploit module name associated with an iOS privilege-escalation vulnerability (integer overflow in memory mapping) affecting iOS 14.5–15.7.6.
A named Coruna exploit/underlying vulnerability used as a zero-day in Operation Triangulation; later details became publicly available per Kaspersky commentary.
Named iOS exploit component reused within the Coruna exploit framework; previously linked to Operation Triangulation (2023).
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.