Loading malware…
Coruna is a modular iOS exploitation and payload framework containing 23 exploits organized into five complete exploit chains targeting iOS 13.0 through 17.2.1. It compromises susceptible iPhones through Safari when users visit malicious or compromised websites, without requiring application installation or additional approval prompts. Delivery commonly uses watering-hole attacks and hidden iframes, including on fraudulent finance, cryptocurrency, and gambling websites.
The framework fingerprints the device and operating-system version to select suitable exploitation components. Its chains combine browser code execution, security-mitigation bypasses, sandbox escape, and kernel privilege escalation before loading native implants. Coruna injects code into legitimate system processes, including power and location services, to conceal execution. Its post-exploitation components support command-and-control communication, application launching, persistence, data exfiltration, and cryptocurrency theft. Encrypted modular packaging, exploit-artifact cleanup, and anti-analysis checks further complicate detection and investigation.
Coruna's cryptocurrency-theft components harvest wallet recovery phrases and keystore information. Associated payloads include PlasmaLoader, which targets cryptocurrency applications and searches Apple Notes for recovery phrases. Combined DarkSword/Coruna deployments also inject wallet-specific collection modules into running applications and search photographs and notes for checksum-valid BIP39 phrases. In these deployments, DarkSword supplies device exploitation while Coruna supplies staged payloads and wallet-theft functionality.
Coruna has been used by a customer of a commercial surveillance vendor, in espionage targeting Ukrainian users, and in financially motivated campaigns in China. Cryptocurrency-theft operations have been associated with UNC6691. The framework has subsequently been reused by additional operators and combined with DarkSword tooling. Its established exploit chains target previously patched vulnerabilities, leaving devices running outdated iOS releases exposed.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
13 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The final payload module is the operational core of the Coruna exploit chain. It transforms all of the preceding exploitation infrastructure into a functioning implant.
CVE-2023-43000: Another use-after-free vulnerability impacting macOS, iOS, and Safari, often exploited in exploit kits like Coruna for chaining attacks.
That domain redirects to the watering hole at utaq[.]cfww[.]shop/gooll/gooll.html, which embeds the Coruna exploit kit delivery framework analyzed in this report.
That domain redirects to the watering hole at utaq[.]cfww[.]shop/gooll/gooll.html, which embeds the Coruna exploit kit delivery framework analyzed in this report.
That domain redirects to the watering hole at utaq[.]cfww[.]shop/gooll/gooll.html, which embeds the Coruna exploit kit delivery framework analyzed in this report.
...анализ которой выявил внутренние имена эксплойтов и авторское название фреймворка — Coruna... В результате исследования выяснилось, что фреймворк эксплуатирует ряд ранее исправленных уязвимостей, в том числе CVE-2023-32434 и CVE-2023-38606.
...анализ которой выявил внутренние имена эксплойтов и авторское название фреймворка — Coruna... В результате исследования выяснилось, что фреймворк эксплуатирует ряд ранее исправленных уязвимостей, в том числе CVE-2023-32434 и CVE-2023-38606.
Coruna is one of those kits. Twenty-three exploits. Five full exploit chains. Coverage from iOS 13.0 through 17.2.1.
Coruna is one of those kits. Twenty-three exploits. Five full exploit chains. Coverage from iOS 13.0 through 17.2.1.
Coruna is one of those kits. Twenty-three exploits. Five full exploit chains. Coverage from iOS 13.0 through 17.2.1.
Coruna is one of those kits. Twenty-three exploits. Five full exploit chains. Coverage from iOS 13.0 through 17.2.1.
Coruna is one of those kits. Twenty-three exploits. Five full exploit chains. Coverage from iOS 13.0 through 17.2.1.
Last week, the iPhone maker also expanded patches for four security flaws (CVE-2023-43010, CVE-2023-43000, CVE-2023-41974, and CVE-2024-23222) that were weaponized as part of the Coruna exploit kit.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The final payload module is the operational core of the Coruna exploit chain. It transforms all of the preceding exploitation infrastructure into a functioning implant.
the Singaporean host (now no longer active) has been found to host an administration panel for Coruna, another iOS exploit kit that predates DarkSword and goes after iOS versions 3.0 through 17.2.1.
The story of Coruna and DarkSword has been already extensively reported on... A highly sophisticated exploit chain for iOS and other mobile operating systems... The original appearance of the malware kit was significant as it combined a set of exploits and zero-days to blast through iOS protections...
32 distinct techniques documented for this family, organized by ATT&CK tactic.
Victim visits compromised/lure site (gambling, fake exchange) ... Hidden iFrame loads exploit from b27.icu | Delivery spans at least 6 domains ... via watering-hole vectors on fake crypto exchanges and gambling sites.
Coruna is a multi-stage, multi-platform exploit chain targeting Apple's Safari/WebKit engine and XNU kernel on ARM64 (arm64e) devices running iOS and macOS. Operated by UNC6691... the chain progresses from browser exploitation through kernel compromise to persistent root-level access.
JavaScript handles network I/O (downloads, uploads, script injection), while the shellcode controls the operations via state word manipulation. | The browser exploitation documented in Sections 1-10 is Stage 1 ... 28 JavaScript modules (~559 KB) with 167 XOR-encoded strings
Every subsequent native function call in the exploit chain - malloc, free, memset, memmove, ObjC message sends, and Mach kernel traps - ultimately flows through ct.call(). | The exploit chain loads via hidden iFrame... parsing Mach-O binaries from JavaScript, scanning system framework memory for ROP/JOP gadgets, bypassing Apple's Pointer Authentication Codes (PAC), escaping the JIT cage...
The kernel exploit is a 64-bit ARM64 dynamic library (2.00 MB), designed for injection into a running process via dlopen or direct memory mapping.
"[The framework] is relying on outdated versions of the iOS exploit" and references "exploit chains."
Each trigger module implements a different strategy for reaching the same goal: hijacking a native callback to invoke attacker-controlled function pointers with PAC-valid signatures. | The pattern is the same GOT-swap technique... By temporarily replacing the Za GOT entry with the target address... Each layer adds one GOT swap... Save - Read and store the current value of 1-7 GOT entries Swap - Write attacker-controlled values... Trigger... Restore...
The exploit causes the runtime to PAC-sign the target address as part of normal message dispatch... it swaps Yl/Wl GOT entries, trigger via ca.call(), restore in finally... The fallback chain ultimately calls l.sh()... with multiple {Sr, Zt} (swap-restore) pairs - each pair specifying a GOT address.
the server sends a DOWNLOAD instruction containing the URL for dump.bin ... then injected into the powerd system daemon for execution
All strings in the framework are XOR-encoded at rest ... Every string in the framework is XOR-encoded with a per-module key
Loads embedded Mach-O binary ... Uses dlsym for dynamic resolution
All follow the same delivery pattern: a fraudulent gambling site or fake cryptocurrency exchange (e.g., impersonating WEEX) serves as the visible lure page, while the Coruna exploit chain loads via hidden iFrame.
the server sends a DOWNLOAD instruction containing the URL for dump.bin ... then injected into the powerd system daemon for execution
The cleanup routine ( kA() ) injects dummy DOM elements and manipulates browser history entries, then removes them after a delay.
The cleanup routine (kA()) injects dummy DOM elements and manipulates browser history entries, then removes both after 10,000ms.
The tI4mjA method implements a module-within-a-module pattern... atob(base64) // decode base64 to JavaScript source → eval(source)
PAC bypass temporarily overwrites unsigned GOT entries in __AUTH_CONST , then triggers legitimate Apple framework code paths
Anti-analysis Corellium VM detection, developer mode checks, Lockdown Mode avoidance
Each trigger module implements a different strategy for reaching the same goal: hijacking a native callback to invoke attacker-controlled function pointers with PAC-valid signatures. | The pattern is the same GOT-swap technique... By temporarily replacing the Za GOT entry with the target address... Each layer adds one GOT swap... Save - Read and store the current value of 1-7 GOT entries Swap - Write attacker-controlled values... Trigger... Restore...
The exploit causes the runtime to PAC-sign the target address as part of normal message dispatch... it swaps Yl/Wl GOT entries, trigger via ca.call(), restore in finally... The fallback chain ultimately calls l.sh()... with multiple {Sr, Zt} (swap-restore) pairs - each pair specifying a GOT address.
"The system shows functionality to fingerprint and track infected targets"
Step 1: /dev/disk0s1s1 ... Step 4: /private/var/MobileSoftwareUpdate/mnt1
Anti-caching: Every GET request appends a random query parameter... This defeats naive URL-based caching and deduplication. | the binary is partially obfuscated through XOR pairs - each sensitive byte is expressed as two large integers whose XOR produces the intended value... XOR-decoded string data... XOR-obfuscated constants
POST ... GET ... Content-Type ... application/json ... application/javascript | Bidirectional C2 via ArrayBuffer ... JavaScript handles network I/O (downloads, uploads, script injection)
343 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
82 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
The report describes Coruna-like exploit kit activity targeting vulnerable, outdated iOS versions. Injected iframes redirect website visitors to exploit-hosting domains for drive-by exploitation. Current iOS versions are reportedly not vulnerable to these kits. The wording indicates similarity to Coruna rather than confirmed identification.
An established iOS exploitation toolkit whose older binaries and exploit chains underpin Godkiller V1 and are reused by Ghostwave and Liangri_26. The article states that Apple has patched most vulnerabilities exploited by the original tooling and describes its historical adoption by scammers and cryptocurrency thieves.
An iPhone exploit kit delivered through malicious or compromised websites. It selects exploits for the visitor’s device, chains browser exploitation with sandbox escape and elevated system access, and delivers payloads for information theft. The content describes its progression from surveillance use to espionage against Ukrainian users and financially motivated campaigns. Its final payload, PlasmaLoader, targets cryptocurrency wallets and recovery phrases stored in Apple Notes.
An iOS exploit kit reported as weaponized against iPhones running iOS 13.0 through 17.2.1. The article also describes it as a companion payload kit distributed alongside DarkSword, with stages executing in the victim's browser after DarkSword exploitation. Its wallet-harvesting modules steal cryptocurrency recovery phrases, balances, and keystore data. Operators deploy both kits using their own C2 infrastructure.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.