UNC6691

UNC6691 is a financially motivated China-based threat actor associated with broad exploitation of Apple iOS devices for cryptocurrency theft. The group has been linked to operational use of the Coruna exploit kit, also known as CryptoWaters, a sophisticated multi-stage framework that targets Safari/WebKit and the XNU kernel on vulnerable iPhone devices and, in some reporting, Apple ARM64 macOS systems. UNC6691 is notable for repurposing spyware-grade exploit capability for criminal monetization rather than traditional espionage. By late 2025, UNC6691 was observed deploying Coruna at scale through fake gambling, cryptocurrency, and other finance-themed Chinese-language websites, often using hidden iframe-based delivery. Unlike earlier more selective uses of the framework, UNC6691 reportedly removed geographic restrictions and spread the exploit chain broadly. After browser exploitation and kernel compromise, the operation delivered post-exploitation malware including PlasmaLoader or PLASMAGRID, which was customized to steal cryptocurrency wallet data and seed phrases from infected devices and to retrieve additional modules. Coruna activity associated with UNC6691 demonstrates advanced capabilities across the attack lifecycle, including initial access via malicious web content, device fingerprinting, anti-analysis checks, PAC bypass, sandbox escape, kernel privilege escalation, entitlement forgery, root-level post-exploitation, persistence, encrypted payload delivery, and data exfiltration. Reporting also describes anti-forensics and defense-evasion behavior, including cleanup of browser artifacts and checks for Lockdown Mode and analysis environments. The actor has been tied specifically to cryptocurrency-focused theft operations rather than ransomware or extortion. UNC6691 is one of several clusters reported to have used Coruna, alongside a surveillance-vendor customer and the separate group UNC6353, illustrating secondary-market diffusion of advanced mobile exploit tooling.