Google and iVerify researchers identified a sophisticated iPhone exploit kit named Coruna. The toolkit contains five distinct attack methods. These methods leverage 23 vulnerabilities to compromise devices. Affected systems include iPhones running iOS versions 13 through 17.2.1.
The toolkit originated with a suspected government surveillance vendor. Russian state-sponsored actors initially used the tools to target Ukrainian users. Chinese-speaking cybercriminals now utilize the kit for financial theft.
This migration signals an expanding market for second-hand zero-day exploits. Nation-state cyberweapons are increasingly accessible to a broader range of malicious actors.