Threat Actor Characterization
Coruna Exploit Kit
ID: d607f878b4c740c3ddd2289562a16a6c39250| Coruna | The Coruna Exploit Kit | — | — |
Actor Network Graph
Open Network GraphMITRE ATT&CK®
Coruna is a sophisticated iOS exploit kit publicly disclosed in 2026 and observed across surveillance, suspected Russian espionage, and financially motivated Chinese-linked campaigns. It delivers browser-based exploitation against iPhones on iOS 13.0 through 17.2.1 using device fingerprinting, hidden iFrames, staged loaders, and modular post-exploitation.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1189 | Drive-by Compromise | TA0001 | |
| T1592 | Gather Victim Host Information | TA0043 |
|
| T1027 | Obfuscated Files or Information | TA0005 |
|
| T1203 | Exploitation for Client Execution | TA0002 |
|
| T1620 | Reflective Code Loading | TA0005 |
|
| T1497 | Virtualization/Sandbox Evasion | TA0005 TA0007 |
|
| T1071.001 | Web Protocols | TA0011 |
|
| T1568.002 | Domain Generation Algorithms | TA0011 |
|
Classification: TLP:WHITE — Open Source Intelligence (OSINT)
Category: Cyber / Exploit Kit / Mobile Exploitation Framework — Origin: Unknown (code authorship unknown; public use observed across surveillance, espionage, and financially motivated clusters)
Author: iQBlack CTI Team
Executive Summary
Coruna is a powerful iOS exploit kit publicly disclosed in March 2026. Public reporting indicates that the framework targeted Apple iPhone devices running iOS 13.0 through 17.2.1 and contained five full exploit chains and a total of 23 exploits. The kit appears to have been engineered as a reusable exploitation framework rather than a single campaign-specific package.
The most important analytical feature of Coruna is not only its technical depth, but its apparent proliferation across multiple threat contexts over the course of 2025. Public reporting describes initial use by a customer of a commercial surveillance vendor, later deployment in watering-hole operations against Ukrainian users by a suspected Russian espionage cluster, and subsequent mass use by a financially motivated China-based actor through fake finance and cryptocurrency websites. This progression strongly suggests capability transfer, resale, repurposing, or re-weaponization of an advanced mobile exploitation stack.
Hunting Playbook — Coruna Exploit Kit
Priority: High for high-risk iPhone users, finance/crypto-themed lure exposure, and Ukrainian / Eastern Europe web ecosystems; Medium elsewhere.