Coruna: The iOS Exploit Kit That Went From Spyware Vendor to Mass Crypto Theft
Google GTIG and iVerify independently disclosed Coruna, an iOS exploit kit containing 23 exploits across 5 full chains targeting iOS 13 through 17.2.1. Originally built for a commercial surveillance vendor, it proliferated to a Russian espionage group (UNC6353) for watering hole attacks against Ukraine, then to a Chinese financially motivated actor (UNC6691) mass-deploying it via fake crypto sites to steal wallet credentials. This post breaks down the exploit chains, payload architecture, detection artifacts, and IOCs.