Loading malware…
Coruna is a sophisticated multi-stage iOS exploit framework targeting iOS 13.0 through 17.2.1. It uses Safari/WebKit-based browser exploitation followed by sandbox escape and kernel privilege-escalation components to deploy the PLASMAGRID implant. The framework selects exploit packages according to device architecture and firmware version, uses encrypted and compressed payload containers, and incorporates multiple exploit chains covering WebKit, pointer-authentication bypass, and XNU kernel vulnerabilities, including CVE-2023-32434, CVE-2023-38606, and CVE-2023-41974.
Coruna has been delivered through watering-hole operations in which compromised or fraudulent websites load concealed browser-exploitation content. Following compromise, PLASMAGRID can inject into legitimate iOS system processes, establish command-and-control, launch applications, collect and exfiltrate device data, and harvest cryptocurrency wallet seed phrases. The framework includes anti-analysis and anti-forensic functionality, including device and environment checks, cleanup of exploit artifacts, and process-based evasion.
Coruna has been observed in targeted activity associated with a commercial-surveillance-vendor customer and in proliferated operations attributed to UNC6353, a suspected Russian espionage actor targeting Ukrainian interests, and UNC6691, a Chinese financially motivated actor associated with cryptocurrency theft. Its reuse by distinct surveillance, espionage, and criminal operators demonstrates the proliferation of advanced iOS exploitation capabilities beyond their original operators.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
13 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The final payload module is the operational core of the Coruna exploit chain. It transforms all of the preceding exploitation infrastructure into a functioning implant.
CVE-2023-43000: Another use-after-free vulnerability impacting macOS, iOS, and Safari, often exploited in exploit kits like Coruna for chaining attacks.
That domain redirects to the watering hole at utaq[.]cfww[.]shop/gooll/gooll.html, which embeds the Coruna exploit kit delivery framework analyzed in this report.
That domain redirects to the watering hole at utaq[.]cfww[.]shop/gooll/gooll.html, which embeds the Coruna exploit kit delivery framework analyzed in this report.
That domain redirects to the watering hole at utaq[.]cfww[.]shop/gooll/gooll.html, which embeds the Coruna exploit kit delivery framework analyzed in this report.
...анализ которой выявил внутренние имена эксплойтов и авторское название фреймворка — Coruna... В результате исследования выяснилось, что фреймворк эксплуатирует ряд ранее исправленных уязвимостей, в том числе CVE-2023-32434 и CVE-2023-38606.
...анализ которой выявил внутренние имена эксплойтов и авторское название фреймворка — Coruna... В результате исследования выяснилось, что фреймворк эксплуатирует ряд ранее исправленных уязвимостей, в том числе CVE-2023-32434 и CVE-2023-38606.
Coruna is one of those kits. Twenty-three exploits. Five full exploit chains. Coverage from iOS 13.0 through 17.2.1.
Coruna is one of those kits. Twenty-three exploits. Five full exploit chains. Coverage from iOS 13.0 through 17.2.1.
Coruna is one of those kits. Twenty-three exploits. Five full exploit chains. Coverage from iOS 13.0 through 17.2.1.
Coruna is one of those kits. Twenty-three exploits. Five full exploit chains. Coverage from iOS 13.0 through 17.2.1.
Coruna is one of those kits. Twenty-three exploits. Five full exploit chains. Coverage from iOS 13.0 through 17.2.1.
Last week, the iPhone maker also expanded patches for four security flaws (CVE-2023-43010, CVE-2023-43000, CVE-2023-41974, and CVE-2024-23222) that were weaponized as part of the Coruna exploit kit.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The final payload module is the operational core of the Coruna exploit chain. It transforms all of the preceding exploitation infrastructure into a functioning implant.
the Singaporean host (now no longer active) has been found to host an administration panel for Coruna, another iOS exploit kit that predates DarkSword and goes after iOS versions 3.0 through 17.2.1.
The story of Coruna and DarkSword has been already extensively reported on... A highly sophisticated exploit chain for iOS and other mobile operating systems... The original appearance of the malware kit was significant as it combined a set of exploits and zero-days to blast through iOS protections...
32 distinct techniques documented for this family, organized by ATT&CK tactic.
Victim visits compromised/lure site (gambling, fake exchange) ... Hidden iFrame loads exploit from b27.icu | Delivery spans at least 6 domains ... via watering-hole vectors on fake crypto exchanges and gambling sites.
Coruna is a multi-stage, multi-platform exploit chain targeting Apple's Safari/WebKit engine and XNU kernel on ARM64 (arm64e) devices running iOS and macOS. Operated by UNC6691... the chain progresses from browser exploitation through kernel compromise to persistent root-level access.
JavaScript handles network I/O (downloads, uploads, script injection), while the shellcode controls the operations via state word manipulation. | The browser exploitation documented in Sections 1-10 is Stage 1 ... 28 JavaScript modules (~559 KB) with 167 XOR-encoded strings
Every subsequent native function call in the exploit chain - malloc, free, memset, memmove, ObjC message sends, and Mach kernel traps - ultimately flows through ct.call(). | The exploit chain loads via hidden iFrame... parsing Mach-O binaries from JavaScript, scanning system framework memory for ROP/JOP gadgets, bypassing Apple's Pointer Authentication Codes (PAC), escaping the JIT cage...
The kernel exploit is a 64-bit ARM64 dynamic library (2.00 MB), designed for injection into a running process via dlopen or direct memory mapping.
"[The framework] is relying on outdated versions of the iOS exploit" and references "exploit chains."
Each trigger module implements a different strategy for reaching the same goal: hijacking a native callback to invoke attacker-controlled function pointers with PAC-valid signatures. | The pattern is the same GOT-swap technique... By temporarily replacing the Za GOT entry with the target address... Each layer adds one GOT swap... Save - Read and store the current value of 1-7 GOT entries Swap - Write attacker-controlled values... Trigger... Restore...
The exploit causes the runtime to PAC-sign the target address as part of normal message dispatch... it swaps Yl/Wl GOT entries, trigger via ca.call(), restore in finally... The fallback chain ultimately calls l.sh()... with multiple {Sr, Zt} (swap-restore) pairs - each pair specifying a GOT address.
the server sends a DOWNLOAD instruction containing the URL for dump.bin ... then injected into the powerd system daemon for execution
All strings in the framework are XOR-encoded at rest ... Every string in the framework is XOR-encoded with a per-module key
Loads embedded Mach-O binary ... Uses dlsym for dynamic resolution
All follow the same delivery pattern: a fraudulent gambling site or fake cryptocurrency exchange (e.g., impersonating WEEX) serves as the visible lure page, while the Coruna exploit chain loads via hidden iFrame.
the server sends a DOWNLOAD instruction containing the URL for dump.bin ... then injected into the powerd system daemon for execution
The cleanup routine ( kA() ) injects dummy DOM elements and manipulates browser history entries, then removes them after a delay.
The cleanup routine (kA()) injects dummy DOM elements and manipulates browser history entries, then removes both after 10,000ms.
The tI4mjA method implements a module-within-a-module pattern... atob(base64) // decode base64 to JavaScript source → eval(source)
PAC bypass temporarily overwrites unsigned GOT entries in __AUTH_CONST , then triggers legitimate Apple framework code paths
Anti-analysis Corellium VM detection, developer mode checks, Lockdown Mode avoidance
Each trigger module implements a different strategy for reaching the same goal: hijacking a native callback to invoke attacker-controlled function pointers with PAC-valid signatures. | The pattern is the same GOT-swap technique... By temporarily replacing the Za GOT entry with the target address... Each layer adds one GOT swap... Save - Read and store the current value of 1-7 GOT entries Swap - Write attacker-controlled values... Trigger... Restore...
The exploit causes the runtime to PAC-sign the target address as part of normal message dispatch... it swaps Yl/Wl GOT entries, trigger via ca.call(), restore in finally... The fallback chain ultimately calls l.sh()... with multiple {Sr, Zt} (swap-restore) pairs - each pair specifying a GOT address.
"The system shows functionality to fingerprint and track infected targets"
Step 1: /dev/disk0s1s1 ... Step 4: /private/var/MobileSoftwareUpdate/mnt1
Anti-caching: Every GET request appends a random query parameter... This defeats naive URL-based caching and deduplication. | the binary is partially obfuscated through XOR pairs - each sensitive byte is expressed as two large integers whose XOR produces the intended value... XOR-decoded string data... XOR-obfuscated constants
POST ... GET ... Content-Type ... application/json ... application/javascript | Bidirectional C2 via ArrayBuffer ... JavaScript handles network I/O (downloads, uploads, script injection)
299 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
74 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An iOS-focused C2/spyware framework that fingerprints and tracks infected devices and is configured to collect cryptocurrency wallets, SMS messages, and photos. The observed deployment was apparently an AI-generated, error-prone recreation using public Coruna materials and screenshots, with demo/mock-data functionality.
A mature iOS exploit framework/spyware platform used for mass device targeting via watering-hole attacks. It chains browser exploits, sandbox escapes, and privilege-escalation flaws, injects into legitimate system processes for stealth, and supports C2, process injection, data exfiltration, app launching, and cryptocurrency theft.
An exploit kit injected via a compromised npm package into built web applications, targeting iOS devices.
An older iOS exploit framework mentioned as co-resident with DarkSword on prior infrastructure.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.