Loading malware…
Coruna is a modular iOS exploitation framework comprising 23 exploits organized into five exploit chains, with established coverage spanning iOS 13.0 through 17.2.1. It compromises iPhones through Safari/WebKit exploitation, browser sandbox escape, and kernel privilege escalation, then loads native post-exploitation components. Its vulnerabilities include previously patched flaws such as CVE-2023-32434, CVE-2023-38606, and CVE-2023-41974, leaving outdated devices exposed despite available fixes.
Delivery uses watering-hole attacks and hidden frames on compromised or attacker-controlled websites, including cryptocurrency and gambling lures. A browser stager fingerprints the device and selects components according to operating-system version, architecture, and processor generation. Exploit packages and payloads use encrypted, compressed containers. Post-exploitation components inject code into legitimate system processes, establish persistence, clean exploitation artifacts, and communicate with command-and-control infrastructure. Anti-analysis checks and process injection reduce visibility, while fallback domain generation supports continued communications.
Coruna deployments include the PLASMAGRID implant and cryptocurrency-wallet harvesting modules. These components steal wallet recovery phrases and keystore data, collect application information, and exfiltrate stolen material. Wallet-focused deployments inject specialized modules into running wallet applications and search photographs and Apple Notes for checksum-valid recovery phrases. Coruna payloads have also been bundled with DarkSword, allowing its theft components to operate after a separate exploitation chain obtains device access.
The framework has been used by a customer of a commercial surveillance vendor, UNC6353 in attacks against Ukrainian targets, and the financially motivated UNC6691 in Chinese cryptocurrency-theft campaigns. Its reuse across espionage and criminal operations demonstrates the proliferation of sophisticated mobile exploitation tooling beyond its original users.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
13 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The final payload module is the operational core of the Coruna exploit chain. It transforms all of the preceding exploitation infrastructure into a functioning implant.
CVE-2023-43000: Another use-after-free vulnerability impacting macOS, iOS, and Safari, often exploited in exploit kits like Coruna for chaining attacks.
That domain redirects to the watering hole at utaq[.]cfww[.]shop/gooll/gooll.html, which embeds the Coruna exploit kit delivery framework analyzed in this report.
That domain redirects to the watering hole at utaq[.]cfww[.]shop/gooll/gooll.html, which embeds the Coruna exploit kit delivery framework analyzed in this report.
That domain redirects to the watering hole at utaq[.]cfww[.]shop/gooll/gooll.html, which embeds the Coruna exploit kit delivery framework analyzed in this report.
...анализ которой выявил внутренние имена эксплойтов и авторское название фреймворка — Coruna... В результате исследования выяснилось, что фреймворк эксплуатирует ряд ранее исправленных уязвимостей, в том числе CVE-2023-32434 и CVE-2023-38606.
...анализ которой выявил внутренние имена эксплойтов и авторское название фреймворка — Coruna... В результате исследования выяснилось, что фреймворк эксплуатирует ряд ранее исправленных уязвимостей, в том числе CVE-2023-32434 и CVE-2023-38606.
Coruna is one of those kits. Twenty-three exploits. Five full exploit chains. Coverage from iOS 13.0 through 17.2.1.
Coruna is one of those kits. Twenty-three exploits. Five full exploit chains. Coverage from iOS 13.0 through 17.2.1.
Coruna is one of those kits. Twenty-three exploits. Five full exploit chains. Coverage from iOS 13.0 through 17.2.1.
Coruna is one of those kits. Twenty-three exploits. Five full exploit chains. Coverage from iOS 13.0 through 17.2.1.
Coruna is one of those kits. Twenty-three exploits. Five full exploit chains. Coverage from iOS 13.0 through 17.2.1.
Last week, the iPhone maker also expanded patches for four security flaws (CVE-2023-43010, CVE-2023-43000, CVE-2023-41974, and CVE-2024-23222) that were weaponized as part of the Coruna exploit kit.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The final payload module is the operational core of the Coruna exploit chain. It transforms all of the preceding exploitation infrastructure into a functioning implant.
the Singaporean host (now no longer active) has been found to host an administration panel for Coruna, another iOS exploit kit that predates DarkSword and goes after iOS versions 3.0 through 17.2.1.
The story of Coruna and DarkSword has been already extensively reported on... A highly sophisticated exploit chain for iOS and other mobile operating systems... The original appearance of the malware kit was significant as it combined a set of exploits and zero-days to blast through iOS protections...
32 distinct techniques documented for this family, organized by ATT&CK tactic.
Victim visits compromised/lure site (gambling, fake exchange) ... Hidden iFrame loads exploit from b27.icu | Delivery spans at least 6 domains ... via watering-hole vectors on fake crypto exchanges and gambling sites.
Coruna is a multi-stage, multi-platform exploit chain targeting Apple's Safari/WebKit engine and XNU kernel on ARM64 (arm64e) devices running iOS and macOS. Operated by UNC6691... the chain progresses from browser exploitation through kernel compromise to persistent root-level access.
JavaScript handles network I/O (downloads, uploads, script injection), while the shellcode controls the operations via state word manipulation. | The browser exploitation documented in Sections 1-10 is Stage 1 ... 28 JavaScript modules (~559 KB) with 167 XOR-encoded strings
Every subsequent native function call in the exploit chain - malloc, free, memset, memmove, ObjC message sends, and Mach kernel traps - ultimately flows through ct.call(). | The exploit chain loads via hidden iFrame... parsing Mach-O binaries from JavaScript, scanning system framework memory for ROP/JOP gadgets, bypassing Apple's Pointer Authentication Codes (PAC), escaping the JIT cage...
The kernel exploit is a 64-bit ARM64 dynamic library (2.00 MB), designed for injection into a running process via dlopen or direct memory mapping.
"[The framework] is relying on outdated versions of the iOS exploit" and references "exploit chains."
Each trigger module implements a different strategy for reaching the same goal: hijacking a native callback to invoke attacker-controlled function pointers with PAC-valid signatures. | The pattern is the same GOT-swap technique... By temporarily replacing the Za GOT entry with the target address... Each layer adds one GOT swap... Save - Read and store the current value of 1-7 GOT entries Swap - Write attacker-controlled values... Trigger... Restore...
The exploit causes the runtime to PAC-sign the target address as part of normal message dispatch... it swaps Yl/Wl GOT entries, trigger via ca.call(), restore in finally... The fallback chain ultimately calls l.sh()... with multiple {Sr, Zt} (swap-restore) pairs - each pair specifying a GOT address.
the server sends a DOWNLOAD instruction containing the URL for dump.bin ... then injected into the powerd system daemon for execution
All strings in the framework are XOR-encoded at rest ... Every string in the framework is XOR-encoded with a per-module key
Loads embedded Mach-O binary ... Uses dlsym for dynamic resolution
All follow the same delivery pattern: a fraudulent gambling site or fake cryptocurrency exchange (e.g., impersonating WEEX) serves as the visible lure page, while the Coruna exploit chain loads via hidden iFrame.
the server sends a DOWNLOAD instruction containing the URL for dump.bin ... then injected into the powerd system daemon for execution
The cleanup routine ( kA() ) injects dummy DOM elements and manipulates browser history entries, then removes them after a delay.
The cleanup routine (kA()) injects dummy DOM elements and manipulates browser history entries, then removes both after 10,000ms.
The tI4mjA method implements a module-within-a-module pattern... atob(base64) // decode base64 to JavaScript source → eval(source)
PAC bypass temporarily overwrites unsigned GOT entries in __AUTH_CONST , then triggers legitimate Apple framework code paths
Anti-analysis Corellium VM detection, developer mode checks, Lockdown Mode avoidance
Each trigger module implements a different strategy for reaching the same goal: hijacking a native callback to invoke attacker-controlled function pointers with PAC-valid signatures. | The pattern is the same GOT-swap technique... By temporarily replacing the Za GOT entry with the target address... Each layer adds one GOT swap... Save - Read and store the current value of 1-7 GOT entries Swap - Write attacker-controlled values... Trigger... Restore...
The exploit causes the runtime to PAC-sign the target address as part of normal message dispatch... it swaps Yl/Wl GOT entries, trigger via ca.call(), restore in finally... The fallback chain ultimately calls l.sh()... with multiple {Sr, Zt} (swap-restore) pairs - each pair specifying a GOT address.
"The system shows functionality to fingerprint and track infected targets"
Step 1: /dev/disk0s1s1 ... Step 4: /private/var/MobileSoftwareUpdate/mnt1
Anti-caching: Every GET request appends a random query parameter... This defeats naive URL-based caching and deduplication. | the binary is partially obfuscated through XOR pairs - each sensitive byte is expressed as two large integers whose XOR produces the intended value... XOR-decoded string data... XOR-obfuscated constants
POST ... GET ... Content-Type ... application/json ... application/javascript | Bidirectional C2 via ArrayBuffer ... JavaScript handles network I/O (downloads, uploads, script injection)
341 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
77 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An iOS exploit kit reported as weaponized against iPhones running iOS 13.0 through 17.2.1. The article also describes it as a companion payload kit distributed alongside DarkSword, with stages executing in the victim's browser after DarkSword exploitation. Its wallet-harvesting modules steal cryptocurrency recovery phrases, balances, and keystore data. Operators deploy both kits using their own C2 infrastructure.
An iPhone wallet-theft toolkit delivered through DarkSword. A SpringBoard coordinator injects theft modules into supported wallet applications. The implant also searches photos and Apple Notes for BIP39 recovery phrases, validates their checksums before exfiltration, collects contacts, updates itself, and retrieves settings. Researchers identified 18 wallet modules in the exposed kit and a nineteenth targeting BitKeep in samples from infections in the wild. A production-server copy contained 11 stolen recovery phrases, but neither the total victim count nor the cryptocurrency losses was established.
Companion payload platform deployed after iOS exploitation. It injects wallet-specific modules into application processes and steals recovery phrases, balances, and keystore data. Its implant also searches photos and Notes for checksum-valid BIP39 phrases and collects other device information. The recovered production infrastructure contained 11 victim recovery phrases and 179 device loot directories. Separate wild builds used 66ds[.]lol and added BitKeep to the wallet targets.
An iOS-focused C2/spyware framework that fingerprints and tracks infected devices and is configured to collect cryptocurrency wallets, SMS messages, and photos. The observed deployment was apparently an AI-generated, error-prone recreation using public Coruna materials and screenshots, with demo/mock-data functionality.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.