Coruna iOS Kit Reuses 2023 Triangulation Exploit Code in New Mass Attacks

The Coruna iOS exploit kit shares the same kernel exploit code as the 2023 Operation Triangulation campaign, confirming a common author and ongoing development.

• •Coruna contains five full iOS exploit chains and 23 exploits total, including CVE-2023-32434 and CVE-2023-38606, both originally used as zero-days in Operation Triangulation
• •Kaspersky confirmed the kernel exploits in both campaigns share the same code and exploitation framework, created by the same author
• •Coruna has been expanded to support Apple A17, M3, M3 Pro, and M3 Max processors, and targets iOS versions 13.0 through 17.2.1
• •Attacks begin via compromised websites on Safari, fingerprinting the browser to deliver a tailored exploit chain that executes a kernel exploit and drops a final implant
• •The kit has been used by a suspected Russia-aligned actor in watering hole attacks in Ukraine and mass campaigns using fake gambling/crypto sites to deliver PlasmaLoader malware

This summary was automatically generated by AI based on the original article and may not be fully accurate.