Coruna iOS Exploit Kit Linked to Attacks by Russian-Linked and Criminal Groups
Summary
GTIG and iVerify report that Coruna contains 23 exploits across five chains targeting iOS 13–17.2.1. They describe its use against Ukrainian users and in later campaigns, and recommend updating to iOS 17.3 or newer.
Key points
- GTIG and iVerify independently analyzed Coruna, an exploit kit with 23 exploits across five chains targeting iOS 13 through 17.2.1.
- GTIG tracked the kit in watering-hole attacks against Ukrainian users by UNC6353, a group it describes as suspected Russian state-sponsored espionage.
- GTIG later observed Coruna in a wider campaign by UNC6691, described as a financially motivated criminal group operating out of China.
- The later campaign used fake Chinese websites to steer potential cryptocurrency users on iOS devices to the exploit kit.
- iVerify describes a recovered one-click chain combining Safari remote code execution with local privilege escalation.
- GTIG’s analysis found the kit withdraws if Lockdown Mode is enabled or the user is in private browsing.
- The article recommends iOS 17.3 or newer; Lockdown Mode is suggested when updating is not possible.
Article Details
- Event Type
- Discovery and analysis of Coruna, an iOS exploit kit used in attacks attributed to state-linked and financially motivated groups.
- Impact
- The kit contains 23 exploits across five exploit chains targeting iOS 13 through 17.2.1, including Safari remote code execution and local privilege escalation. Reported activity includes attacks against Ukrainian users and later campaigns focused on cryptocurrency and bitcoin wallet theft. The article says the kit is ineffective against iOS 17.3 or newer and recommends enabling Lockdown Mode when updating is not possible.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | mxbc-v2[.]tjbjdod[.]cn | Suspicious website identified by iVerify that hosted a page containing exploits from the kit. |
Threat Actors
Vendors
Products
iOSMultiple iOS exploits and five exploit chains have been found in a single exploit kit once used by Russian state actors against Ukrainians.Safari“The obtained 1-click exploit chain consists of Remote Code Execution (RCE) in Safari and a Local Privilege Escalation (LPE) exploit allowing attackers to take control over infected devices,” it reports.