Feds take notice of iOS vulnerabilities exploited under mysterious circumstances

Exclusive: The Coruna Exploit Kit—A Multi-Million Dollar iPhone Hacking Arsenal Now in the Hands of Multiple Threat Actors

In a chilling revelation that has sent shockwaves through the cybersecurity community, Google has uncovered the existence of a sophisticated iOS exploit kit dubbed “Coruna”—a multi-million dollar arsenal of 23 zero-day and n-day vulnerabilities that has been weaponized by at least three distinct hacking groups, including suspected Russian espionage actors and financially motivated Chinese cybercriminals.

The Discovery That Changed Everything

The story begins in February 2025, when Google’s Threat Analysis Group first detected Coruna in use by a “customer of a surveillance vendor.” What made this discovery particularly alarming was that the vulnerability being exploited—CVE-2025-23222—had already been patched 13 months earlier, suggesting that sophisticated threat actors were hoarding and trading these powerful tools in a shadowy underground market.

By July 2025, the same exploit kit had surfaced in attacks against Ukrainian targets, this time leveraging CVE-2023-43000. The final piece of the puzzle fell into place in December when a “financially motivated threat actor from China” deployed Coruna, allowing Google researchers to retrieve the complete exploit kit—a treasure trove of iOS hacking capabilities that would send Apple’s security team scrambling.

What Makes Coruna So Dangerous?

Coruna isn’t just another exploit kit—it’s a comprehensive, professionally developed platform that can target iPhones running iOS versions from 13.0 (released in September 2019) all the way through 17.2.1 (December 2023). The kit contains five full iOS exploit chains, each meticulously crafted to bypass multiple layers of Apple’s security architecture.

The exploits within Coruna are organized into distinct categories, each representing a different attack vector:

• WebContent Read/Write exploits that allow attackers to manipulate Safari’s rendering engine
• PAC bypass exploits that circumvent Pointer Authentication Code, Apple’s cutting-edge security feature
• Sandbox escape exploits that break out of iOS’s application isolation
• Privilege Escalation (PE) exploits that grant attackers root-level access
• PPL Bypass exploits that defeat Apple’s Page Protection Layer, the final security barrier

The Codenames Tell a Story

What’s particularly fascinating is that when Google retrieved the complete kit, they discovered a debug version had been deployed, revealing the internal code names assigned by Coruna’s developers. These codenames—like “buffout,” “jacurutu,” “bluebird,” and “cassowary”—suggest a team with both technical sophistication and a flair for creativity.

The kit’s name itself, “Coruna,” appears to be an internal designation, adding an air of mystery to its origins. Was it developed by a nation-state? A private surveillance company? A criminal syndicate? The evidence points to a professional operation with significant resources and expertise.

The Exploit Matrix: A Timeline of iPhone Vulnerabilities

The 23 exploits in Coruna represent a comprehensive timeline of iPhone security flaws spanning nearly five years of iOS development. Here’s what makes this particularly concerning:

1. Historical Depth: The exploits cover vulnerabilities from iOS 13 through iOS 17, meaning even users who diligently update their devices remain at risk if they haven’t installed the latest patches.

2. Technical Sophistication: Each exploit chain is designed to work together, with later exploits compensating for security improvements in newer iOS versions.

3. Wide Device Coverage: The kit can target various iPhone models, from older devices to the latest releases, making it a versatile tool for attackers.

4. Multiple Attack Vectors: By combining different types of exploits, attackers can create sophisticated attack chains that are extremely difficult to defend against.

Who’s Using Coruna—and Why It Matters

The fact that three distinct groups have acquired Coruna is perhaps the most troubling aspect of this discovery. Google’s analysis suggests an active market for “second-hand” zero-day exploits, where powerful hacking tools are bought, sold, and traded among different threat actors.

The groups identified include:

• Surveillance Vendors: Commercial entities selling hacking capabilities to governments and law enforcement
• State-Sponsored Actors: Suspected Russian espionage groups targeting Ukrainian interests
• Financially Motivated Criminals: Chinese actors likely seeking to steal financial data or conduct espionage for economic gain

This proliferation of powerful exploits among different types of threat actors represents a fundamental shift in the cybersecurity landscape. As Google researchers noted, “multiple threat actors have now acquired advanced exploitation techniques that can be re-used and modified with newly identified vulnerabilities.”

The Technical Breakdown: How Coruna Works

Let’s dive deeper into the technical capabilities that make Coruna so formidable:

WebContent Exploits: These vulnerabilities target Safari’s WebContent process, allowing attackers to execute arbitrary code within the browser context. The exploits progress chronologically, with “buffout” targeting iOS 13-15.1.1, “jacurutu” covering 15.2-15.5, and so on, demonstrating how the kit evolved to bypass new security measures.

PAC Bypass Exploits: Pointer Authentication Code is one of Apple’s most significant security innovations, designed to prevent return-oriented programming attacks. Coruna’s “breezy,” “breezy15,” “seedbell,” and related exploits demonstrate that even this advanced protection can be circumvented by determined attackers.

Sandbox Escapes: These exploits, codenamed “IronLoader” and “NeuronLoader,” break the fundamental security principle that keeps iOS apps isolated from each other. Once an attacker escapes the sandbox, they can access data from other applications and system resources.

Privilege Escalation: The PE exploits in Coruna, with names like “Neutron,” “Dynamo,” “Pendulum,” “Photon,” and “Parallax,” progressively escalate attacker privileges from user-level access to complete system control.

PPL Bypass: The final layer of defense, Apple’s Page Protection Layer, is defeated by exploits like “Quark,” “Gallium,” “Carbone,” “Sparrow,” and “Rocket.” These represent the most advanced capabilities in the kit, allowing attackers to bypass even Apple’s last-ditch security measures.

The Government Response: CISA Takes Action

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has responded swiftly to this threat, adding three of the CVEs to its catalog of known exploited vulnerabilities. These include:

• CVE-2021-30952: Apple Multiple Products Integer Overflow or Wraparound Vulnerability
• CVE-2023-41974: Apple iOS and iPadOS Use-After-Free Vulnerability
• CVE-2023-43000: Apple Multiple products Use-After-Free Vulnerability

CISA is directing federal agencies to “apply mitigations per vendor instructions” and warning that “these types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.”

The Bigger Picture: A Wake-Up Call for Mobile Security

The discovery of Coruna represents more than just another security vulnerability—it’s a wake-up call about the state of mobile device security in an era of sophisticated cyber threats.

The Exploit Economy: The fact that multiple groups have acquired Coruna suggests a thriving underground market for zero-day exploits. This “exploit economy” operates with significant financial incentives, driving continuous innovation in attack techniques.

The Patch Gap: Many of the vulnerabilities in Coruna had been patched months or even years before they were detected in the wild, highlighting the persistent challenge of getting users to update their devices promptly.

The Sophistication Gap: Coruna demonstrates that attackers are increasingly able to bypass even Apple’s advanced security features, suggesting that current mobile security architectures may need fundamental rethinks.

What This Means for iPhone Users

For the average iPhone user, the Coruna discovery is concerning but not necessarily cause for panic. Here’s what you should know:

1. Update Immediately: If you’re running any iOS version between 13.0 and 17.2.1, check for and install the latest updates. Apple has likely patched many of these vulnerabilities in subsequent releases.

2. Be Cautious with Links: Many of these exploits are delivered through malicious websites, so exercise caution when clicking on links from unknown sources.

3. Consider Your Threat Model: While these exploits are primarily being used against high-value targets like government officials and journalists, the proliferation of such tools means that sophisticated attacks could eventually trickle down to affect ordinary users.

4. Stay Informed: The cybersecurity landscape is constantly evolving, and staying informed about new threats is your best defense.

The Future of Mobile Security

The Coruna exploit kit represents a new era in mobile device exploitation—one where sophisticated, multi-component attack platforms are developed, traded, and deployed by multiple threat actors. As mobile devices become increasingly central to our lives, containing everything from personal photos to banking information, the stakes for mobile security have never been higher.

Apple and other device manufacturers will need to respond with innovative new security measures, while users will need to become more proactive about device security. Meanwhile, the discovery of Coruna serves as a stark reminder that in the world of cybersecurity, the attackers often have access to tools that are just as sophisticated—if not more so—than those used by defenders.

The Bottom Line

Coruna isn’t just an exploit kit—it’s a window into the future of mobile device exploitation, a future where powerful hacking tools are increasingly accessible to a wide range of threat actors. As this underground market continues to evolve, one thing is clear: the battle for mobile security is far from over, and users, manufacturers, and security researchers will all need to step up their game to stay ahead of the curve.

Tags & Viral Phrases:

• iPhone Zero-Day Exploit
• Apple Security Breach
• iOS Vulnerability
• Mobile Hacking Kit
• State-Sponsored Cyberattacks
• Russian Espionage
• Chinese Cybercrime
• Google Threat Analysis
• CISA Warning
• Mobile Device Security
• Zero-Day Market
• iPhone Hacking
• iOS Exploit Chain
• Apple Vulnerability
• Cybersecurity Threat
• Mobile Espionage
• Surveillance Vendor
• iOS Patch Gap
• Mobile Security Architecture
• Cyber Threat Intelligence

,