Loading story…
Google-owned Mandiant disclosed infrastructure tied to Coruna, an iOS exploit kit delivered through a large network of disposable domains and subdomains. The identified URLs used both HTTP and HTTPS and followed recurring path patterns such as /group.html, /tuiliu/group.html, /static/analytics.html, and /88k4ez/group.html, indicating coordinated staging, traffic routing, or payload delivery across the operation.
The delivery network included cryptocurrency-themed, gaming-themed, app-store-themed, and typo-squatted domains designed to imitate legitimate brands or attract victims with lures related to digital assets and mobile apps. The breadth and branding of the infrastructure suggest a flexible campaign architecture built to rotate domains quickly, mask exploit delivery, and support continued distribution of the Coruna iOS exploit kit.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Google Cloud's Mandiant Threat Intelligence blog published a reference identifying numerous URLs and domains used to deliver the Coruna iOS exploit kit. The disclosed infrastructure showed coordinated staging patterns across cryptocurrency-themed, gaming-themed, and typo-squatted domains using recurring paths such as /group.html and /static/analytics.html.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 109 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
urlscan.io
Open sourcemacrumors.com
Open sourcecloud.google.com
Open sourcecloud.google.com
Open sourcecloud.google.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google’s Threat Intelligence Group (GTIG) reported on **Coruna**, a commercial/spy-grade iOS exploit kit that has circulated among multiple threat actors and shifted use cases over time—from a surveillance customer to suspected state-linked watering-hole activity and later to financially motivated abuse. GTIG assessed Coruna includes **five full iOS exploit chains** comprising **23 exploits**, mixing CVE-tracked vulnerabilities with additional flaws that were not assigned CVEs (with CVE mapping potentially subject to revision as analysis continues). The exploit chains target iOS via ordinary web content, leveraging **WebKit memory-corruption** and related browser subsystem weaknesses to achieve capabilities such as **remote code execution** and **sandbox escape**. Reporting highlighted that Coruna’s exploit set largely relies on older issues that are likely patched on current devices, but the kit was assessed as capable (with varying reliability) of targeting iPhone models across a wide range of versions, from **iOS 13.0 through iOS 17.2.1**. Publicly referenced CVEs associated with Coruna include **CVE-2024-23222**, **CVE-2022-48503** (later added to CISA’s KEV), **CVE-2023-43000**, and multiple WebKit/privilege escalation bugs used as zero-days in prior campaigns (e.g., **CVE-2023-38606**, **CVE-2023-32434**, **CVE-2023-32409**). Mandiant/Google also published a set of **URLs observed delivering Coruna** landing pages (e.g., paths like `/group.html` and `/static/analytics.html` across numerous domains), intended to support detection and threat hunting.
Aug 10, 2026
Researchers reported that the **Coruna** iOS exploitation framework contains full exploit chains and roughly **23 exploits** targeting iPhones running **iOS 13 through 17.2/17.2.1**, and that it has been used by multiple threat actors, including **UNC6353**, a suspected Russian espionage group conducting watering-hole attacks against Ukrainian users, and **UNC6691**, a financially motivated China-based actor. The toolkit, also referred to as **CryptoWaters**, has been described as a rare case of **nation-state-grade iPhone exploitation** appearing in broader criminal operations, with post-exploitation activity including the **PLASMAGRID** payload and persistence through a process identified as `com.apple.assistd` that injects into the `powerd` daemon running as root. Reporting also highlighted competing views on the toolkit's origin. One account said evidence suggests parts of Coruna may have originated from **Trenchant**, a hacking and surveillance division of **L3Harris**, and later leaked into the wider ecosystem, ultimately reaching foreign intelligence services and cybercriminals. However, technical threat research noted that the **definitive origin remains unconfirmed**, even as analysts observed reuse of vulnerabilities associated with **Operation Triangulation** and CISA added **`CVE-2023-41974`** to the **Known Exploited Vulnerabilities** catalog after Google's publication. The story is substantive threat intelligence, not fluff, because it concerns an active exploit framework, real-world exploitation, and possible proliferation of advanced offensive capabilities.
Jun 29, 2026
Researchers identified an exposed Chinese-language environment dubbed **Robobox** that appears associated with the Coruna/Bee iOS command-and-control ecosystem, an exploit framework previously reverse engineered from its JavaScript components. Hunt.io attack-capture data showed a dashboard and Node.js backend, deployment documentation, mock operational data, a Cobalt Strike team server, a Linux remote-access trojan, and malware-staging services. The exposed instance appears to have been a test or demonstration deployment rather than a confirmed active Coruna operation. The infrastructure also contained a fake Sogou Pinyin update chain aimed at mainland Chinese users that reportedly served `ImageMagik.dll` and `SGWangzaix.exe`. Researchers observed repetitive commands, implementation defects, and React/Vite, backend, and documentation artifacts consistent with AI- or LLM-assisted development and administration, raising concern that operators are testing more autonomous malware creation, reconnaissance, and deployment workflows. The operators' identity, the environment's intended purpose, and whether victims downloaded the staged payloads remain unconfirmed.
Sep 3, 2026