--- title: Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit description: Google Threat Intelligence Group (GTIG) has uncovered Coruna, a sophisticated iOS exploit kit containing 5 full exploit chains and 23 total exploits targeting... canonical: https://daily.dev/posts/coruna-the-mysterious-journey-of-a-powerful-ios-exploit-kit-1dzwihmpn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit | daily.dev og:description: Google Threat Intelligence Group (GTIG) has uncovered Coruna, a sophisticated iOS exploit kit containing 5 full exploit chains and 23 total exploits targeting... og:url: https://daily.dev/posts/coruna-the-mysterious-journey-of-a-powerful-ios-exploit-kit-1dzwihmpn og:image: https://api.daily.dev/og/posts/1dZwIhMpn.png og:image:alt: Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit **[Google Cloud](https://daily.dev/sources/gcp)** · 10 min read · 0 upvotes · 0 comments ## Summary Google Threat Intelligence Group (GTIG) has uncovered Coruna, a sophisticated iOS exploit kit containing 5 full exploit chains and 23 total exploits targeting iOS 13.0 through 17.2.1. The kit was first spotted in February 2025 used by a commercial surveillance vendor customer, then observed in watering hole attacks against Ukrainian users by suspected Russian espionage group UNC6353, and finally recovered in full from fake Chinese financial websites operated by financially motivated actor UNC6691. The kit features advanced non-public exploitation techniques, PAC bypasses, and reuses vulnerabilities from Operation Triangulation. Its payload (PLASMAGRID) injects into iOS system daemons, steals cryptocurrency wallet credentials from 18 apps, scans for BIP39 seed phrases, and uses a DGA seeded with 'lazarus' for C2 fallback. The proliferation across unrelated threat actors suggests an active secondary market for zero-day exploits. iOS users are urged to update to the latest version or enable Lockdown Mode. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Coruna framework: an exploit kit and ties to Operation Triangulation](https://daily.dev/posts/coruna-framework-an-exploit-kit-and-ties-to-operation-triangulation-zs6mrhdhs) · Securelist · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#crypto](https://daily.dev/tags/crypto) [View this post on daily.dev](https://daily.dev/posts/coruna-the-mysterious-journey-of-a-powerful-ios-exploit-kit-1dzwihmpn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit","url":"https://daily.dev/posts/coruna-the-mysterious-journey-of-a-powerful-ios-exploit-kit-1dzwihmpn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/coruna-the-mysterious-journey-of-a-powerful-ios-exploit-kit-1dzwihmpn"},"datePublished":"2026-03-03T15:14:08.461Z","dateModified":"2026-03-03T15:14:34.867Z","description":"Google Threat Intelligence Group (GTIG) has uncovered Coruna, a sophisticated iOS exploit kit containing 5 full exploit chains and 23 total exploits targeting...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/efb6ebdd31507ed6cdc6e0fe53ac3537?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/efb6ebdd31507ed6cdc6e0fe53ac3537?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Google Cloud","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Google Cloud","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/gcp","url":"https://daily.dev/sources/gcp"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/coruna-the-mysterious-journey-of-a-powerful-ios-exploit-kit-1dzwihmpn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,crypto","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Google Cloud","item":"https://daily.dev/sources/gcp"},{"@type":"ListItem","position":3,"name":"Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit"}]} ```