Coruna iPhone Exploit Kit Linked to Russian Espionage and Criminal Use

Researchers reported that the Coruna iOS exploitation framework contains full exploit chains and roughly 23 exploits targeting iPhones running iOS 13 through 17.2/17.2.1, and that it has been used by multiple threat actors, including UNC6353, a suspected Russian espionage group conducting watering-hole attacks against Ukrainian users, and UNC6691, a financially motivated China-based actor. The toolkit, also referred to as CryptoWaters, has been described as a rare case of nation-state-grade iPhone exploitation appearing in broader criminal operations, with post-exploitation activity including the PLASMAGRID payload and persistence through a process identified as com.apple.assistd that injects into the powerd daemon running as root.

Reporting also highlighted competing views on the toolkit's origin. One account said evidence suggests parts of Coruna may have originated from Trenchant, a hacking and surveillance division of L3Harris, and later leaked into the wider ecosystem, ultimately reaching foreign intelligence services and cybercriminals. However, technical threat research noted that the definitive origin remains unconfirmed, even as analysts observed reuse of vulnerabilities associated with Operation Triangulation and CISA added CVE-2023-41974 to the Known Exploited Vulnerabilities catalog after Google's publication. The story is substantive threat intelligence, not fluff, because it concerns an active exploit framework, real-world exploitation, and possible proliferation of advanced offensive capabilities.