Full Report
The Coruna exploit kit is an evolution of the framework used in the Operation Triangulation espionage campaign, which in 2023 targeted iPhones via zero-click iMessage exploits. [...]
Analysis Summary
# Tool/Technique: Coruna Exploit Framework
## Overview
Coruna is a sophisticated iOS exploit kit and framework that functions as the successor and evolution of the framework used in "Operation Triangulation." While originally designed for high-end cyber-espionage, it has transitioned into broader use, including financially motivated attacks. It leverages zero-click and one-click vectors to deploy spyware by chaining multiple vulnerabilities to bypass modern hardware security features.
## Technical Details
- **Type:** Exploit Framework / Malware Tool
- **Platform:** iOS (ARM64 and ARM64E architectures)
- **Capabilities:** Device fingerprinting, RCE (Remote Code Execution), PAC (Pointer Authentication Code) bypass, Kernel exploitation, and automated spyware deployment.
- **First Seen:** Evolution of a framework active since 2019; Coruna specifically tracked into 2024-2026 in the context of modern iOS versions (up to iOS 17.2).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link] (Safari/Web-based delivery)
- **[TA0002 - Execution]**
- [T1203 - Exploitation for Client Execution]
- **[TA0004 - Privilege Escalation]**
- [T1068 - Exploitation for Privilege Escalation] (Kernel exploits)
- **[TA0005 - Defense Evasion]**
- [T1140 - Deinterlace/Decode Files or Information] (ChaCha20 decryption, LZMA decompression)
- [T1614.001 - System Location Discovery: System Language Discovery] (Device fingerprinting/stager)
- **[TA0007 - Discovery]**
- [T1082 - System Information Discovery] (Checking chipsets A17/M3)
## Functionality
### Core Capabilities
- **Multi-Stage Infection:** Begins with a Safari-based stager that fingerprints the device to select the optimal exploit chain.
- **Sophisticated Payload Handling:** Uses custom container formats, LZMA decompression, and ChaCha20 encryption to deliver and execute components.
- **Extensive Exploit Library:** Contains five full exploit chains leveraging 23 vulnerabilities.
- **Broad Compatibility:** Targets modern Apple hardware including A17, M3, M3 Pro, and M3 Max chips.
### Advanced Features
- **Hardware-Level Bypass:** Specifically designed to bypass hardware-based security protections like PAC by leveraging undocumented hardware features.
- **Architecture Awareness:** Explicitly checks for and adapts to ARM64 and ARM64E architectures.
- **Kernel Exploitation:** Includes updated versions of critical kernel exploits used in the original Triangulation campaign (CVE-2023-32434 and CVE-2023-38606).
## Indicators of Compromise
- **File Hashes:** Specific hashes not provided in the article, but payloads are known to utilize Mach-O loaders and LZMA/ChaCha20 modules.
- **Network Indicators:**
- Malicious Safari-based stager URLs (typically delivered via iMessage or fake exchange websites).
- C2 infrastructure used for retrieving encrypted metadata (indicators defanged).
- **Behavioral Indicators:**
- Unexpected Safari crashes or high resource usage during fingerprinting.
- Presence of unrecognized Mach-O binaries in sensitive mobile directories.
## Associated Threat Actors
- **Operation Triangulation Actors:** High-level espionage group (linked to previous attacks on Kaspersky network).
- **Unidentified Cybercriminals:** Recent use in financially motivated campaigns targeting cryptocurrency users via fake exchange sites.
## Detection Methods
- **Behavioral Detection:** Monitoring for unusual Safari process behavior or unauthorized kernel-level access attempts.
- **Network Defense:** Inspecting traffic for the retrieval of large, encrypted blobs following a web-view interaction.
- **System Integrity:** Monitoring for deviations in standard iOS system checks (though difficult on non-jailbroken devices).
## Mitigation Strategies
- **Patch Management:** Immediate update to the latest iOS version (vulnerabilities addressed in patches following iOS 17.2).
- **Lockdown Mode:** Utilizing Apple's "Lockdown Mode" to reduce the attack surface for zero-click exploits.
- **User Education:** Warning users against interacting with suspicious links in iMessage or untrusted cryptocurrency exchange sites.
## Related Tools/Techniques
- **Operation Triangulation Framework:** The direct predecessor.
- **DarkSword:** A similar, publicly available iOS exploit kit used for infostealing and espionage.
- **CVE-2023-32434 / CVE-2023-38606:** Critical kernel vulnerabilities leveraged by the kit.