--- title: Coruna, DarkSword iOS Exploits Proliferate Globally description: Nation-state-grade iOS exploit chains Coruna and DarkSword are proliferating beyond government and mercenary operators into organized cybercrime. iVerify has... canonical: https://daily.dev/posts/coruna-darksword-ios-exploits-proliferate-globally-fhoedhgdq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Coruna, DarkSword iOS Exploits Proliferate Globally | daily.dev og:description: Nation-state-grade iOS exploit chains Coruna and DarkSword are proliferating beyond government and mercenary operators into organized cybercrime. iVerify has... og:url: https://daily.dev/posts/coruna-darksword-ios-exploits-proliferate-globally-fhoedhgdq og:image: https://api.daily.dev/og/posts/fhOEdhGDq.png og:image:alt: Coruna, DarkSword iOS Exploits Proliferate Globally og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Coruna, DarkSword iOS Exploits Proliferate Globally **[Dark Reading](https://daily.dev/sources/dr)** · 5 min read · 0 upvotes · 0 comments ## Summary Nation-state-grade iOS exploit chains Coruna and DarkSword are proliferating beyond government and mercenary operators into organized cybercrime. iVerify has tracked approximately 17,000 domains hosting second-generation variants. DarkSword targets iOS 18.4–18.7 using six CVEs and was patched by Apple in April; Coruna targets iOS 13–17.2.1, deploys 23 vulnerabilities across five exploit chains, and cost an estimated $30–40 million to develop. Threat actors have begun combining techniques from both frameworks into hybrid variants dubbed 'Darkuna,' adding improved jailbreak detection evasion, stronger encryption, new persistence mechanisms, and Telegram-focused implants. DarkSword's data theft capabilities include keychain credentials, iCloud data, and cryptocurrency wallets, suggesting financially motivated actors were an intended target from the start. Researchers presented detailed analysis at Black Hat USA 2026. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What CVEs does the DarkSword iOS exploit chain use? DarkSword exploits six CVEs: JavaScriptCore memory-corruption flaws CVE-2025-31277 and CVE-2025-43529, dyld user-mode pointer authentication code bypass CVE-2026-20700, ANGLE memory corruption flaw CVE-2025-14174, iOS kernel memory management flaw CVE-2025-43510, and iOS kernel memory corruption bug CVE-2025-43520. It targets iPhones running iOS 18.4 through 18.7 and was patched by Apple in April. _Security teams tracking unpatched iOS CVEs in their fleet find the full chain context on daily.dev._ ### How many vulnerabilities does the Coruna iOS exploit kit use and how much did it cost to develop? Coruna deploys 23 vulnerabilities across five exploit chains and is estimated to have cost between $30 million and $40 million to develop. It targets iOS 13 through 17.2.1, was developed by a government contractor, and sold to zero-day brokers. Apple patched the underlying vulnerabilities in 2023 and 2024. _Researchers tracking commercial spyware economics and exploit kit pricing follow developments like this on daily.dev._ ### What are the 'Darkuna' hybrid iOS exploit variants and how do they differ from Coruna and DarkSword? Darkuna is an informal name given by iVerify to hybrid variants that combine techniques from both the Coruna and DarkSword iOS exploit frameworks. These variants incorporate updated process-injection targets, stronger anti-analysis functionality, new implants, improved jailbreak and virtualization detection, and improved encryption — modifications made by threat actors after public disclosure of the original frameworks. _Threat intelligence teams monitoring post-disclosure exploit evolution keep up with emerging variants on daily.dev._ ## Similar posts on daily.dev - [Apple Breaks Precedent, Patches DarkSword for iOS 18](https://daily.dev/posts/apple-breaks-precedent-patches-darksword-for-ios-18-pdlpe1qbr) · Dark Reading · 2 upvotes · 0 comments - [The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors](https://daily.dev/posts/the-proliferation-of-darksword-ios-exploit-chain-adopted-by-multiple-threat-actors-edycnrtfy) · Google Cloud · 0 upvotes · 0 comments - [Major security alert for iPhone users](https://daily.dev/posts/major-security-alert-for-iphone-users-6l54y270k) · TechCentral · 3 upvotes · 0 comments - [DarkSword: iPhone Exploit Kit Serves Spies & Thieves Alike](https://daily.dev/posts/darksword-iphone-exploit-kit-serves-spies-thieves-alike-ipwp39vqw) · Dark Reading · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/coruna-darksword-ios-exploits-proliferate-globally-fhoedhgdq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Coruna, DarkSword iOS Exploits Proliferate Globally","url":"https://daily.dev/posts/coruna-darksword-ios-exploits-proliferate-globally-fhoedhgdq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/coruna-darksword-ios-exploits-proliferate-globally-fhoedhgdq"},"datePublished":"2026-08-10T17:20:37.954Z","dateModified":"2026-08-10T17:21:14.617Z","description":"Nation-state-grade iOS exploit chains Coruna and DarkSword are proliferating beyond government and mercenary operators into organized cybercrime. iVerify has...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/87ba66e30ac2ee1b190a5d91a0354643?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/87ba66e30ac2ee1b190a5d91a0354643?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/coruna-darksword-ios-exploits-proliferate-globally-fhoedhgdq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"Coruna, DarkSword iOS Exploits Proliferate Globally"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/coruna-darksword-ios-exploits-proliferate-globally-fhoedhgdq#faq","mainEntity":[{"@type":"Question","name":"What CVEs does the DarkSword iOS exploit chain use?","acceptedAnswer":{"@type":"Answer","text":"DarkSword exploits six CVEs: JavaScriptCore memory-corruption flaws CVE-2025-31277 and CVE-2025-43529, dyld user-mode pointer authentication code bypass CVE-2026-20700, ANGLE memory corruption flaw CVE-2025-14174, iOS kernel memory management flaw CVE-2025-43510, and iOS kernel memory corruption bug CVE-2025-43520. It targets iPhones running iOS 18.4 through 18.7 and was patched by Apple in April. Security teams tracking unpatched iOS CVEs in their fleet find the full chain context on daily.dev."}},{"@type":"Question","name":"How many vulnerabilities does the Coruna iOS exploit kit use and how much did it cost to develop?","acceptedAnswer":{"@type":"Answer","text":"Coruna deploys 23 vulnerabilities across five exploit chains and is estimated to have cost between $30 million and $40 million to develop. It targets iOS 13 through 17.2.1, was developed by a government contractor, and sold to zero-day brokers. Apple patched the underlying vulnerabilities in 2023 and 2024. Researchers tracking commercial spyware economics and exploit kit pricing follow developments like this on daily.dev."}},{"@type":"Question","name":"What are the 'Darkuna' hybrid iOS exploit variants and how do they differ from Coruna and DarkSword?","acceptedAnswer":{"@type":"Answer","text":"Darkuna is an informal name given by iVerify to hybrid variants that combine techniques from both the Coruna and DarkSword iOS exploit frameworks. These variants incorporate updated process-injection targets, stronger anti-analysis functionality, new implants, improved jailbreak and virtualization detection, and improved encryption — modifications made by threat actors after public disclosure of the original frameworks. Threat intelligence teams monitoring post-disclosure exploit evolution keep up with emerging variants on daily.dev."}}]} ```