Loading malware…
Coruna is a sophisticated multi-stage iOS exploit framework and implant ecosystem used to compromise Apple mobile devices through browser-based exploitation, primarily via watering-hole attacks and malicious web content. It has been documented targeting iOS versions from 13.0 through 17.2.1, with some reporting also describing related delivery or staging components affecting Apple platforms more broadly. Coruna combines multiple exploit chains and numerous vulnerabilities to achieve remote code execution, sandbox escape, privilege escalation, and post-exploitation execution on fully patched-at-the-time devices in earlier campaigns.
Operationally, Coruna uses web-based staging that fingerprints the victim device and selects version-appropriate exploit components. Public reporting describes Safari and WebKit exploitation, JavaScript and WebAssembly-based browser stages, PAC-bypass techniques, kernel exploitation, and follow-on payload delivery. Post-exploitation behavior includes code injection into legitimate iOS system processes, command-and-control, application launching, process injection, data exfiltration, anti-forensics, and persistence-related launcher activity. Reported implants associated with Coruna include PLASMAGRID, and some reporting links fallback or adjacent loader activity to PlasmaLoader. Observed objectives include espionage and financially motivated theft, especially cryptocurrency theft and harvesting of wallet seed phrases.
Coruna has been associated with multiple distinct operators rather than a single exclusive user. Reported users include a customer of a commercial spyware vendor, the suspected Russian espionage cluster UNC6353 in campaigns against Ukrainian targets, and the Chinese financially motivated actor UNC6691. The framework’s proliferation across espionage, mercenary, and criminal actors has been widely noted as evidence that high-end iOS exploitation has diffused beyond traditional state use. Some reporting also describes later overlap or co-residence with DarkSword infrastructure and hybridization of techniques across the two ecosystems.
Delivery has been observed through compromised or operator-controlled websites, including watering-hole pages and malicious content embedded in web applications or software supply-chain compromises that redirected users into Coruna delivery flows. The framework is notable for stealth, maturity, and breadth of version coverage, and has been characterized as one of the more capable publicly discussed iOS exploit kits of its period.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
13 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The final payload module is the operational core of the Coruna exploit chain. It transforms all of the preceding exploitation infrastructure into a functioning implant.
CVE-2023-43000: Another use-after-free vulnerability impacting macOS, iOS, and Safari, often exploited in exploit kits like Coruna for chaining attacks.
That domain redirects to the watering hole at utaq[.]cfww[.]shop/gooll/gooll.html, which embeds the Coruna exploit kit delivery framework analyzed in this report.
That domain redirects to the watering hole at utaq[.]cfww[.]shop/gooll/gooll.html, which embeds the Coruna exploit kit delivery framework analyzed in this report.
That domain redirects to the watering hole at utaq[.]cfww[.]shop/gooll/gooll.html, which embeds the Coruna exploit kit delivery framework analyzed in this report.
...анализ которой выявил внутренние имена эксплойтов и авторское название фреймворка — Coruna... В результате исследования выяснилось, что фреймворк эксплуатирует ряд ранее исправленных уязвимостей, в том числе CVE-2023-32434 и CVE-2023-38606.
...анализ которой выявил внутренние имена эксплойтов и авторское название фреймворка — Coruna... В результате исследования выяснилось, что фреймворк эксплуатирует ряд ранее исправленных уязвимостей, в том числе CVE-2023-32434 и CVE-2023-38606.
Coruna is one of those kits. Twenty-three exploits. Five full exploit chains. Coverage from iOS 13.0 through 17.2.1.
Coruna is one of those kits. Twenty-three exploits. Five full exploit chains. Coverage from iOS 13.0 through 17.2.1.
Coruna is one of those kits. Twenty-three exploits. Five full exploit chains. Coverage from iOS 13.0 through 17.2.1.
Coruna is one of those kits. Twenty-three exploits. Five full exploit chains. Coverage from iOS 13.0 through 17.2.1.
Coruna is one of those kits. Twenty-three exploits. Five full exploit chains. Coverage from iOS 13.0 through 17.2.1.
Last week, the iPhone maker also expanded patches for four security flaws (CVE-2023-43010, CVE-2023-43000, CVE-2023-41974, and CVE-2024-23222) that were weaponized as part of the Coruna exploit kit.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The final payload module is the operational core of the Coruna exploit chain. It transforms all of the preceding exploitation infrastructure into a functioning implant.
the Singaporean host (now no longer active) has been found to host an administration panel for Coruna, another iOS exploit kit that predates DarkSword and goes after iOS versions 3.0 through 17.2.1.
The story of Coruna and DarkSword has been already extensively reported on... A highly sophisticated exploit chain for iOS and other mobile operating systems... The original appearance of the malware kit was significant as it combined a set of exploits and zero-days to blast through iOS protections...
32 distinct techniques documented for this family, organized by ATT&CK tactic.
Victim visits compromised/lure site (gambling, fake exchange) ... Hidden iFrame loads exploit from b27.icu | Delivery spans at least 6 domains ... via watering-hole vectors on fake crypto exchanges and gambling sites.
Coruna is a multi-stage, multi-platform exploit chain targeting Apple's Safari/WebKit engine and XNU kernel on ARM64 (arm64e) devices running iOS and macOS. Operated by UNC6691... the chain progresses from browser exploitation through kernel compromise to persistent root-level access.
JavaScript handles network I/O (downloads, uploads, script injection), while the shellcode controls the operations via state word manipulation. | The browser exploitation documented in Sections 1-10 is Stage 1 ... 28 JavaScript modules (~559 KB) with 167 XOR-encoded strings
Every subsequent native function call in the exploit chain - malloc, free, memset, memmove, ObjC message sends, and Mach kernel traps - ultimately flows through ct.call(). | The exploit chain loads via hidden iFrame... parsing Mach-O binaries from JavaScript, scanning system framework memory for ROP/JOP gadgets, bypassing Apple's Pointer Authentication Codes (PAC), escaping the JIT cage...
The kernel exploit is a 64-bit ARM64 dynamic library (2.00 MB), designed for injection into a running process via dlopen or direct memory mapping.
WebKit trigger ... Arbitrary R/W in WebKit renderer process ... PAC bypass + JIT cage escape → native code execution
Each trigger module implements a different strategy for reaching the same goal: hijacking a native callback to invoke attacker-controlled function pointers with PAC-valid signatures. | The pattern is the same GOT-swap technique... By temporarily replacing the Za GOT entry with the target address... Each layer adds one GOT swap... Save - Read and store the current value of 1-7 GOT entries Swap - Write attacker-controlled values... Trigger... Restore...
The exploit causes the runtime to PAC-sign the target address as part of normal message dispatch... it swaps Yl/Wl GOT entries, trigger via ca.call(), restore in finally... The fallback chain ultimately calls l.sh()... with multiple {Sr, Zt} (swap-restore) pairs - each pair specifying a GOT address.
the server sends a DOWNLOAD instruction containing the URL for dump.bin ... then injected into the powerd system daemon for execution
All strings in the framework are XOR-encoded at rest ... Every string in the framework is XOR-encoded with a per-module key
Loads embedded Mach-O binary ... Uses dlsym for dynamic resolution
All follow the same delivery pattern: a fraudulent gambling site or fake cryptocurrency exchange (e.g., impersonating WEEX) serves as the visible lure page, while the Coruna exploit chain loads via hidden iFrame.
the server sends a DOWNLOAD instruction containing the URL for dump.bin ... then injected into the powerd system daemon for execution
The cleanup routine ( kA() ) injects dummy DOM elements and manipulates browser history entries, then removes them after a delay.
The cleanup routine (kA()) injects dummy DOM elements and manipulates browser history entries, then removes both after 10,000ms.
The tI4mjA method implements a module-within-a-module pattern... atob(base64) // decode base64 to JavaScript source → eval(source)
PAC bypass temporarily overwrites unsigned GOT entries in __AUTH_CONST , then triggers legitimate Apple framework code paths
Anti-analysis Corellium VM detection, developer mode checks, Lockdown Mode avoidance
Each trigger module implements a different strategy for reaching the same goal: hijacking a native callback to invoke attacker-controlled function pointers with PAC-valid signatures. | The pattern is the same GOT-swap technique... By temporarily replacing the Za GOT entry with the target address... Each layer adds one GOT swap... Save - Read and store the current value of 1-7 GOT entries Swap - Write attacker-controlled values... Trigger... Restore...
The exploit causes the runtime to PAC-sign the target address as part of normal message dispatch... it swaps Yl/Wl GOT entries, trigger via ca.call(), restore in finally... The fallback chain ultimately calls l.sh()... with multiple {Sr, Zt} (swap-restore) pairs - each pair specifying a GOT address.
Capture document.URL ... Capture navigator.userAgent ... Environment fingerprinting - hw.model , Corellium detection, kernel version parsing, SoC offset table selection
Step 1: /dev/disk0s1s1 ... Step 4: /private/var/MobileSoftwareUpdate/mnt1
Anti-caching: Every GET request appends a random query parameter... This defeats naive URL-based caching and deduplication. | the binary is partially obfuscated through XOR pairs - each sensitive byte is expressed as two large integers whose XOR produces the intended value... XOR-decoded string data... XOR-obfuscated constants
POST ... GET ... Content-Type ... application/json ... application/javascript | Bidirectional C2 via ArrayBuffer ... JavaScript handles network I/O (downloads, uploads, script injection)
297 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
73 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A mature iOS exploit framework/spyware platform used for mass device targeting via watering-hole attacks. It chains browser exploits, sandbox escapes, and privilege-escalation flaws, injects into legitimate system processes for stealth, and supports C2, process injection, data exfiltration, app launching, and cryptocurrency theft.
An exploit kit injected via a compromised npm package into built web applications, targeting iOS devices.
An older iOS exploit framework mentioned as co-resident with DarkSword on prior infrastructure.
An older iOS exploit framework mentioned as previously co-resident with DarkSword infrastructure.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.