Nation-State iOS Exploit Kit ‘Coruna’ Found Powering Global Attacks

Google and iVerify analysis reveals a powerful exploit kit originally used by Russian state actors that is now appearing in broader criminal campaigns.

Multiple iOS exploits and five exploit chains have been found in a single exploit kit once used by Russian state actors against Ukrainians.

Separate reports analyzing the same iOS threat were published on the same day by Google Threat Intelligence Group (GTIG) and iVerify. GTIG first came across the threat in February 2025. It later learned, after discovering the full code, that the developers called the kit Coruna.

iVerify came across the same exploit kit independently and has spent several weeks conducting its own independent technical analysis. Both reports describe Coruna as an exploit kit containing 23 exploits across five full exploit chains targeting iOS 13 through 17.2.1.

GTIG says its technical value lies in the more advanced exploits “using non-public exploitation techniques and mitigation ...