Government-Grade iPhone Exploit Kit 'Coruna' Proliferated from Spy Tool to Cryptocurrency Heist in Under a Year
Google and iVerify reveal Coruna, a 23-exploit iOS framework that moved from a surveillance vendor to Russian spies to Chinese cybercriminals in months.
Overview
A sophisticated iPhone exploit kit that researchers believe originated from a U.S. government-linked surveillance contractor has traversed one of the most alarming supply chains in recent cybersecurity history — moving from a commercial spyware vendor to a Russian espionage operation to a Chinese criminal gang conducting mass cryptocurrency theft, all within roughly twelve months.
The framework, named Coruna, was simultaneously disclosed on March 3, 2026 by Google’s Threat Intelligence Group and mobile security firm iVerify, marking what both organizations characterized as the first known mass exploitation of iOS devices by a criminal group using tools likely built by a nation-state.
Technical Architecture
Coruna is a modular exploit framework targeting Apple iPhones running iOS versions 13.0 through 17.2.1, containing 23 individual vulnerabilities organized across five complete attack chains, according to The Hacker News. The kit begins with a JavaScript fingerprinting layer that silently checks a visiting device’s model, system version, and security configuration before selecting the appropriate exploit chain.
Once a target device is identified, the framework progressively compromises the iPhone’s security layers — chaining a WebKit remote code execution exploit with pointer authentication code bypasses — to achieve high-level privileges and install persistent malware. The kit includes a deliberate evasion mechanism: it aborts the entire attack process if the target device has Lockdown Mode enabled or the user is browsing in private mode, suggesting its authors anticipated use against technically sophisticated targets.
Several of the 23 vulnerabilities overlap with those exploited in Operation Triangulation, the long-running iOS spyware campaign that Kaspersky attributed to U.S. intelligence in 2023. Boris Larin, a Kaspersky researcher who led that investigation, noted that the shared CVEs — including CVE-2023-32434 and CVE-2023-38606 — are “not trivial bugs,” stating: “CVE-2023-32434 gives an attacker full control over the deepest layer of iOS — the kernel.” He also noted that many users remain exposed because they have not updated their devices despite Apple having patched the vulnerabilities and backported fixes as far back as iOS 15.7.x.
Proliferation Timeline
Google’s tracking of Coruna reveals three distinct phases of ownership, each representing an escalation in the breadth and nature of the attack.
In early 2025, researchers first encountered fragments of an iOS exploit chain being used by a customer of an unnamed commercial surveillance vendor. The sophistication of the code and its architecture led iVerify to conclude that it was likely built on frameworks associated with U.S. government hacking tools. Rocky Cole of iVerify described the codebase as “superb” and “elegantly written,” noting that comments in the code were “really reminiscent of U.S.-based coders.”
By July 2025, according to CyberScoop, the complete Coruna framework had appeared on compromised Ukrainian websites and was attributed to UNC6353, a group Google assesses with moderate confidence to be a Russian espionage operation. Those attacks targeted Ukrainian users — a pattern consistent with Russian intelligence collection priorities during the ongoing conflict.
By December 2025, the same framework had been deployed across a network of fake Chinese financial websites operated by UNC6691, a financially motivated, China-based threat actor. In that campaign, the final payload was PlasmaLoader, a module designed to extract cryptocurrency wallet data and recovery phrases from applications including MetaMask, Exodus, Bitget, and Base.
Suspected Origins and the L3Harris Connection
The question of where Coruna originated carries significant policy implications. iVerify’s analysis concluded that the kit likely originated from a leaked U.S. government framework, based on code quality, architectural patterns, and naming conventions consistent with known American intelligence tooling.
Researcher Costin Raiu noted that Coruna’s internal exploit names — including cassowary, terrorbird, bluebird, jacurutu, and sparrow — match a bird-themed naming convention documented at L3Harris’s Trenchant division, the defense contractor’s offensive cyber unit, which previously produced a publicly known exploit chain called Condor, according to The Hacker News.
That conclusion coincides with a separate criminal case: Peter Williams, a former general manager at L3Harris Trenchant, was sentenced to a little over seven years in prison for selling eight zero-day exploits to Russian exploit broker Operation Zero in exchange for millions of dollars, as reported by The Hacker News.
Google stopped short of directly attributing Coruna’s development to any specific organization but stated the evidence “suggests an active market for second-hand zero-day exploits” — a secondary market where sophisticated tools change hands long after their intended operational use.
CISA Response and Patch Guidance
On March 5, 2026, the U.S. Cybersecurity and Infrastructure Security Agency added three CVEs associated with the Coruna exploit chains to its Known Exploited Vulnerabilities catalog: CVE-2021-30952, CVE-2023-41974, and CVE-2023-43000, according to SecurityWeek. Federal civilian agencies were given a deadline of March 26, 2026 to apply patches.
Apple devices running iOS 17.3 and later are not affected by any of the 23 exploits in the Coruna framework, as all underlying vulnerabilities were patched in successive iOS updates between 2021 and early 2024. Users on older devices that cannot update to current iOS versions remain exposed.
A Warning About Surveillance Tool Proliferation
The Coruna case illustrates a dynamic that security researchers have long warned about but rarely been able to document with such clarity: the lifecycle of government-grade offensive tools does not end with their intended deployment.
iVerify’s Cole drew a direct parallel to EternalBlue, the NSA-developed exploit leaked by the Shadow Brokers in 2017 that was subsequently weaponized in a global ransomware campaign, calling the Coruna discovery a potential “EternalBlue moment” for mobile security. iVerify described Coruna as “one of the most significant examples we’ve observed of sophisticated spyware-grade capabilities proliferating from commercial surveillance vendors into the hands of nation-state actors and ultimately mass-scale criminal operations.”
The Coruna disclosures arrive as lawmakers in the United States and Europe continue debating the regulation of commercial surveillance vendors. The case demonstrates that even tools never publicly sold or marketed can find their way into criminal hands through theft, insider leaks, or secondary markets that operate entirely outside any regulatory framework.
For the hundreds of millions of iOS users who updated their devices in the past two years, the immediate risk from Coruna is low. For those on older, unsupported hardware — a population that security researchers estimate in the tens of millions globally — the arrival of a mass-deployment criminal campaign using government-grade exploits represents a meaningful and novel threat.