{
  "name": "Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit",
  "slug": "coruna-the-mysterious-journey-of-a-powerful-ios-exploit-kit",
  "description": "A sophisticated iOS exploit kit named Coruna has been discovered, targeting iPhones running iOS 13.0 to 17.2.1. The kit contains five full iOS exploit chains and 23 exploits, using advanced techniques and mitigation bypasses. Initially used by a surveillance vendor, it was later employed in targeted attacks against Ukrainian users and broad-scale campaigns by a Chinese financially motivated group. The kit's proliferation suggests an active market for second-hand zero-day exploits. The exploits are well-engineered and documented, with the most advanced using non-public techniques. The ending payload, PLASMAGRID, focuses on stealing financial information and cryptocurrency wallet data.",
  "published": "2026-03-03T14:42:06+00:00",
  "created_at": "2026-03-03T14:42:06+00:00",
  "modified_at": "2026-03-03T15:45:18+00:00",
  "created_at_opencti": "2026-03-03T14:42:06+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2026-03-03",
    "CVE-2020-27932",
    "CVE-2020-27950",
    "CVE-2021-30952",
    "CVE-2022-48503",
    "CVE-2023-32409",
    "CVE-2023-32434",
    "CVE-2023-38606",
    "CVE-2023-41974",
    "CVE-2023-43000",
    "CVE-2024-23222",
    "CVE-2024-23225",
    "CVE-2024-23296",
    "coruna",
    "cryptocurrency",
    "exploit-kit",
    "financial theft",
    "ios",
    "plasmagrid",
    "surveillance",
    "zero-day"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "https://ajskbnrs.xn--jor0b302fdhgwnccw8g.com/gogo/list.html"
      },
      {
        "id": "",
        "name": "https://iphonex.mjdqw.cn/tuiliu/group.html"
      },
      {
        "id": "",
        "name": "https://www.appstoreconn.com/xmweb/group.html"
      },
      {
        "id": "",
        "name": "https://dbgopaxl.com/static/goindex/tuiliu/group.html"
      },
      {
        "id": "",
        "name": "https://share.4u.game/group.html"
      },
      {
        "id": "",
        "name": "https://osec2.668ddf.cc/tuiliu/group.html"
      },
      {
        "id": "",
        "name": "https://pepeairdrop01.com/static/analytics.html"
      },
      {
        "id": "",
        "name": "https://w2a315.tubeluck.com/static/goindex/tuiliu/group.html"
      },
      {
        "id": "",
        "name": "https://anygg.liquorfight.com/88k4ez/group.html"
      },
      {
        "id": "",
        "name": "https://sj9ioz3a7y89cy7.xyz/list.html"
      },
      {
        "id": "",
        "name": "https://lddx3z2d72aa8i6.xyz/group.html"
      },
      {
        "id": "",
        "name": "https://i.binaner.com/group.html"
      },
      {
        "id": "",
        "name": "https://ios.teegrom.top/tuiliu/group.html"
      },
      {
        "id": "",
        "name": "https://seven7.vip/group.html"
      },
      {
        "id": "",
        "name": "https://dd9l7e6ghme8pbk.xyz/group.html"
      },
      {
        "id": "",
        "name": "https://fxrhcnfwxes90q.xyz/group.html"
      },
      {
        "id": "",
        "name": "https://ai-scorepredict.com/static/analytics.html"
      },
      {
        "id": "",
        "name": "https://65sse.668ddf.cc/tuiliu/group.html"
      },
      {
        "id": "",
        "name": "https://7uspin.us/group.html"
      },
      {
        "id": "",
        "name": "https://n49.top/group.html"
      },
      {
        "id": "",
        "name": "http://land.bingo777.now/88k4ez/group.html"
      },
      {
        "id": "",
        "name": "https://7ff.online/group.html"
      },
      {
        "id": "",
        "name": "https://ose.668ddf.cc/tuiliu/group.html"
      },
      {
        "id": "",
        "name": "https://k96.icu/group.html"
      },
      {
        "id": "",
        "name": "http://bestcryptocurrency.top/details/group.html"
      },
      {
        "id": "",
        "name": "https://t7c.icu/group.html"
      },
      {
        "id": "",
        "name": "http://pepeairdrop01.com/static/analytics.html"
      },
      {
        "id": "",
        "name": "https://goanalytics.xyz/88k4ez/group.html"
      },
      {
        "id": "",
        "name": "www.appstoreconn.com"
      },
      {
        "id": "",
        "name": "https://spin7.icu/group.html"
      },
      {
        "id": "",
        "name": "http://ddus17.com/tuiliu/group.html"
      },
      {
        "id": "",
        "name": "https://h4k.icu/group.html"
      },
      {
        "id": "",
        "name": "https://26a.online/group.html"
      },
      {
        "id": "",
        "name": "https://3v5w1km5gv.xyz/group.html"
      },
      {
        "id": "",
        "name": "https://y4w.icu/group.html"
      },
      {
        "id": "",
        "name": "https://7p.game/group.html"
      },
      {
        "id": "",
        "name": "http://land.777bingos.xyz/88k4ez/group.html"
      },
      {
        "id": "",
        "name": "https://share.7p.game/group.html"
      },
      {
        "id": "",
        "name": "http://land.77bingos.com/88k4ez/group.html"
      },
      {
        "id": "",
        "name": "http://cryptocurrencyworld.top/details/group.html"
      },
      {
        "id": "",
        "name": "https://so5083.tubeluck.com/static/goindex/group.html"
      },
      {
        "id": "",
        "name": "https://sadjd.mijieqi.cn/group.html"
      },
      {
        "id": "",
        "name": "http://cdn.uacounter.com/stat.html"
      },
      {
        "id": "",
        "name": "https://4u.game/group.html"
      },
      {
        "id": "",
        "name": "http://goodcryptocurrency.top/details/group.html"
      },
      {
        "id": "",
        "name": "https://b27.icu/group.html"
      },
      {
        "id": "",
        "name": "https://7fun.icu/group.html"
      },
      {
        "id": "",
        "name": "https://mkkku.com/static/analytics.html"
      },
      {
        "id": "",
        "name": "https://kanav.blog/group.html"
      },
      {
        "id": "",
        "name": "https://btrank.top/tuiliu/group.html"
      },
      {
        "id": "",
        "name": "https://land.bingo777.now/88k4ez/group.html"
      },
      {
        "id": "",
        "name": "https://res54allb.xn--xkrsa0078bd6d.com/group.html"
      },
      {
        "id": "",
        "name": "https://98a.online/group.html"
      },
      {
        "id": "",
        "name": "https://cy8.top/group.html"
      },
      {
        "id": "",
        "name": "https://binancealliancesintro.com/group.html"
      },
      {
        "id": "",
        "name": "https://goodcryptocurrency.top/details/group.html"
      },
      {
        "id": "",
        "name": "https://4kgame.us/group.html"
      },
      {
        "id": "",
        "name": "18394fcc096344e0730e49a0098970b1c53c137f679cff5c7ff8902e651cd8a3"
      },
      {
        "id": "",
        "name": "91d44c1f62fd863556aac0190cbef3b46abc4cbe880f80c580a1d258f0484c30"
      },
      {
        "id": "",
        "name": "25a9b004cf61fb251c8d4024a8c7383a86cb30f60aa7d59ca53ce9460fcfb7de"
      },
      {
        "id": "",
        "name": "499f6b1e012d9bc947eea8e23635dfe6464cd7c9d99eb11d5874bd7b613297b1"
      },
      {
        "id": "",
        "name": "721b46b43b7084b98e51ab00606f08a6ccd30b23bef5e542088f0b5706a8f780"
      },
      {
        "id": "",
        "name": "1fb9dedf1de81d387eff4bd5e747f730dd03c440157a66f20fdb5e95f64318c0"
      },
      {
        "id": "",
        "name": "05b5e4070b3b8a130b12ea96c5526b4615fcae121bb802b1a10c3a7a70f39901"
      },
      {
        "id": "",
        "name": "d517c3868c5e7808202f53fa78d827a308d94500ae9051db0a62e11f7852e802"
      },
      {
        "id": "",
        "name": "3c297829353778857edfeaed3ceeeca1bf8b60534f1979f7d442a0b03c56e541"
      },
      {
        "id": "",
        "name": "be28b40df919d3fa87ed49e51135a719bd0616c9ac346ea5f20095cb78031ed9"
      },
      {
        "id": "",
        "name": "42cc02cecd65f22a3658354c5a5efa6a6ec3d716c7fbbcd12df1d1b077d2591b"
      },
      {
        "id": "",
        "name": "2a9d21ca07244932939c6c58699448f2147992c1f49cd3bc7d067bd92cb54f3a"
      },
      {
        "id": "",
        "name": "4dc255504a6c3ea8714ccdc95cc04138dc6c92130887274c8582b4a96ebab4a8"
      },
      {
        "id": "",
        "name": "0dff17e3aa12c4928273c70a2e0a6fff25d3e43c0d1b71056abad34a22b03495"
      },
      {
        "id": "",
        "name": "023e5fb71923cfa2088b9a48ad8566ff7ac92a99630add0629a5edf4679888de"
      },
      {
        "id": "",
        "name": "4dfcf5a71e5a8f27f748ac7fd7760dec0099ce338722215b4a5862b60c5b2bfd"
      },
      {
        "id": "",
        "name": "6eafd742f58db21fbaf5fd7636e6653446df04b4a5c9bca9104e5dfad34f547c"
      },
      {
        "id": "",
        "name": "10bd8f2f8bb9595664bb9160fbc4136f1d796cb5705c551f7ab8b9b1e658085c"
      },
      {
        "id": "",
        "name": "f218068ea943a511b230f2a99991f6d1fbc2ac0aec7c796b261e2a26744929ac"
      },
      {
        "id": "",
        "name": "d371e3bed18ee355438b166bbf3bdaf2e7c6a3af8931181b9649020553b07e7a"
      }
    ],
    "malware": [
      {
        "id": "1999cf2f-3c4e-41fe-b19d-382b5cec47ec",
        "name": "PLASMAGRID",
        "slug": "plasmagrid"
      },
      {
        "id": "dde4a456-21df-48c4-94a2-20a4aed193d1",
        "name": "Coruna",
        "slug": "coruna"
      }
    ],
    "intrusion_sets": [
      {
        "id": "eb0c1bd7-ca39-4d6a-93e9-ce7d5eed7f7b",
        "name": "UNC6691",
        "slug": "unc6691"
      }
    ],
    "attack_patterns": [
      {
        "id": "32817170-4c07-427e-b8a5-80a733ae2550",
        "name": "T1497"
      },
      {
        "id": "0b2b1ecd-d52e-492a-af08-050954bc03e5",
        "name": "T1056"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "a72b6e11-a5d5-4f5a-8f0d-8861e90c34f7",
        "name": "T1555"
      },
      {
        "id": "29398669-98ed-4766-9dac-f9632f7175ff",
        "name": "T1518"
      },
      {
        "id": "60972cf6-e90b-4600-af3c-13c468391d9c",
        "name": "T1106"
      },
      {
        "id": "1e043fe4-2413-4b8e-887c-0fe45d095a24",
        "name": "T1583"
      },
      {
        "id": "6c8f8a40-2746-4a37-86bd-81e82afa6e62",
        "name": "T1190"
      },
      {
        "id": "c12e0e03-aab0-4646-a929-e921a3d27f02",
        "name": "T1219"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "9c5a20d1-0df9-4e99-bcc5-0b731a78b5d1",
        "name": "T1608"
      },
      {
        "id": "e46a9411-d2a1-47c9-8820-c7f818f4c0b5",
        "name": "T1203"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      }
    ],
    "vulnerabilities": [
      {
        "id": "",
        "name": "CVE-2023-41974"
      },
      {
        "id": "",
        "name": "CVE-2023-43000"
      },
      {
        "id": "",
        "name": "CVE-2024-23222"
      },
      {
        "id": "",
        "name": "CVE-2023-32434"
      },
      {
        "id": "",
        "name": "CVE-2023-32409"
      },
      {
        "id": "",
        "name": "CVE-2024-23296"
      },
      {
        "id": "",
        "name": "CVE-2023-38606"
      },
      {
        "id": "",
        "name": "CVE-2020-27950"
      },
      {
        "id": "",
        "name": "CVE-2021-30952"
      },
      {
        "id": "",
        "name": "CVE-2020-27932"
      },
      {
        "id": "",
        "name": "CVE-2022-48503"
      },
      {
        "id": "",
        "name": "CVE-2024-23225"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Ukraine"
      },
      {
        "id": "",
        "name": "Finance"
      },
      {
        "id": "",
        "name": "goodcryptocurrency.top"
      },
      {
        "id": "",
        "name": "2s3b3rknfqtwwpo.xyz"
      },
      {
        "id": "",
        "name": "hui4tbh9uv9x4yi.xyz"
      },
      {
        "id": "",
        "name": "ose.668ddf.cc"
      },
      {
        "id": "",
        "name": "ztvnhmhm4zj95w3.xyz"
      },
      {
        "id": "",
        "name": "ai-scorepredict.com"
      },
      {
        "id": "",
        "name": "roy2tlop2u.xyz"
      },
      {
        "id": "",
        "name": "btrank.top"
      },
      {
        "id": "",
        "name": "pen0axt0u476duw.xyz"
      },
      {
        "id": "",
        "name": "fxrhcnfwxes90q.xyz"
      },
      {
        "id": "",
        "name": "dbgopaxl.com"
      },
      {
        "id": "",
        "name": "seven7.vip"
      },
      {
        "id": "",
        "name": "7fun.icu"
      },
      {
        "id": "",
        "name": "lk4x6x2ejxaw2br.xyz"
      },
      {
        "id": "",
        "name": "cdn.uacounter.com"
      },
      {
        "id": "",
        "name": "rlau616jc7a7f7i.xyz"
      },
      {
        "id": "",
        "name": "lsnngjyu9x6vcg0.xyz"
      },
      {
        "id": "",
        "name": "yvgy29glwf72qnl.xyz"
      },
      {
        "id": "",
        "name": "sadjd.mijieqi.cn"
      },
      {
        "id": "",
        "name": "iphonex.mjdqw.cn"
      },
      {
        "id": "",
        "name": "hfteigt3kt0sf3z.xyz"
      },
      {
        "id": "",
        "name": "ddus17.com"
      },
      {
        "id": "",
        "name": "xmmfrkq9oat1daq.xyz"
      },
      {
        "id": "",
        "name": "gqjs3ra34lyuvzb.xyz"
      },
      {
        "id": "",
        "name": "xfal48cf0ies7ew.xyz"
      },
      {
        "id": "",
        "name": "vvri8ocl4t3k8n6.xyz"
      },
      {
        "id": "",
        "name": "sf2bisx5nhdkygn3l.xyz"
      },
      {
        "id": "",
        "name": "gdvynopz3pa0tik.xyz"
      },
      {
        "id": "",
        "name": "kanav.blog"
      },
      {
        "id": "",
        "name": "i.binaner.com"
      },
      {
        "id": "",
        "name": "ios.teegrom.top"
      },
      {
        "id": "",
        "name": "anygg.liquorfight.com"
      },
      {
        "id": "",
        "name": "res54allb.xn--xkrsa0078bd6d.com"
      },
      {
        "id": "",
        "name": "land.77bingos.com"
      },
      {
        "id": "",
        "name": "4kgame.us"
      },
      {
        "id": "",
        "name": "lddx3z2d72aa8i6.xyz"
      },
      {
        "id": "",
        "name": "xittgveqaufogve.xyz"
      },
      {
        "id": "",
        "name": "zcjdlb5ubkhy41u.xyz"
      },
      {
        "id": "",
        "name": "uawwydy3qas6ykv.xyz"
      },
      {
        "id": "",
        "name": "mkkku.com"
      },
      {
        "id": "",
        "name": "b38w09ecdejfqsf.xyz"
      },
      {
        "id": "",
        "name": "ol67el6pxg03ad7.xyz"
      },
      {
        "id": "",
        "name": "pepeairdrop01.com"
      },
      {
        "id": "",
        "name": "6zvjeulzaw5c0mv.xyz"
      },
      {
        "id": "",
        "name": "binancealliancesintro.com"
      },
      {
        "id": "",
        "name": "osec2.668ddf.cc"
      },
      {
        "id": "",
        "name": "so5083.tubeluck.com"
      },
      {
        "id": "",
        "name": "7uspin.us"
      },
      {
        "id": "",
        "name": "bestcryptocurrency.top"
      },
      {
        "id": "",
        "name": "land.777bingos.xyz"
      },
      {
        "id": "",
        "name": "eg2bjo5x5r8yjb5.xyz"
      },
      {
        "id": "",
        "name": "xjslbdt9jdijn15.xyz"
      },
      {
        "id": "",
        "name": "dd9l7e6ghme8pbk.xyz"
      },
      {
        "id": "",
        "name": "65sse.668ddf.cc"
      },
      {
        "id": "",
        "name": "land.bingo777.now"
      },
      {
        "id": "",
        "name": "w2a315.tubeluck.com"
      },
      {
        "id": "",
        "name": "goanalytics.xyz"
      },
      {
        "id": "",
        "name": "cryptocurrencyworld.top"
      }
    ]
  },
  "external_refs": [
    "https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit/",
    "https://otx.alienvault.com/pulse/69a7014e71ff3fc01a6963ba"
  ]
}