216.73.216.86

Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit

· Published 03/03/2026 15:42 · Modified 03/03/2026 16:45

Export JSON

Essential information

Published
03/03/2026 15:42
Modified
03/03/2026 16:45
Tags
2026-03-03 CVE-2020-27932 CVE-2020-27950 CVE-2021-30952 CVE-2022-48503 CVE-2023-32409 CVE-2023-32434 CVE-2023-38606 CVE-2023-41974 CVE-2023-43000 CVE-2024-23222 CVE-2024-23225 CVE-2024-23296 coruna cryptocurrency exploit-kit financial theft ios plasmagrid surveillance zero-day
Related entities
12 vulnerabilities (cve), 77 observables, 1 intrusion sets (apt), 14 techniques (mitre), 2 malware, 60 others

Description

A sophisticated exploit kit named has been discovered, targeting iPhones running 13.0 to 17.2.1. The kit contains five full exploit chains and 23 exploits, using advanced techniques and mitigation bypasses. Initially used by a vendor, it was later employed in targeted attacks against Ukrainian users and broad-scale campaigns by a Chinese financially motivated group. The kit's proliferation suggests an active market for second-hand exploits. The exploits are well-engineered and documented, with the most advanced using non-public techniques. The ending payload, , focuses on stealing financial information and wallet data.

Related entities

Vulnerabilities, IOCs, intrusion sets, MITRE techniques and other entities referenced in this report.

External references