The Coruna exploit kit is an updated version of the framework seen in the Operation Triangulation spying campaign, which in 2023 exploited iPhones with zero-click attacks through iMessage.

The software now targets newer Apple devices, like those using the A17 and M3 chips, and works on operating systems up to iOS 17.2.

Coruna utilizes five complete exploit chains for iOS, taking advantage of 23 vulnerabilities, including CVE-2023-32434 and CVE-2023-38606, also used in Operation Triangulation.

Kaspersky researchers found, after analyzing the exploit code for these two security vulnerabilities, that Coruna used a more recent version of the exploit initially used in Operation Triangulation, dating back to 2019.

Similarities in the code suggest that this kit is the continuation of the malicious framework from the Triangulation campaign that also targeted iPhones on Kaspersky’s network.

“Our analysis revealed that the kernel exploit used in Coruna for CVE-2023-32434 and CVE-2023-38606 is essentially an updated version of the same exploit employed in Operation Triangulation,” the researchers state in a report today.

Kaspersky’s research indicates that the attack starts in Safari. A piece of code identifies the device, picks suitable exploits, and then gets encrypted data needed for the next steps.

The payload downloads further encrypted components, decrypts them using ChaCha20, decompresses them with LZMA, and analyzes specific container formats to gather package details.

Depending on the device’s architecture and iOS version, it chooses and runs the appropriate kernel exploit, Mach-O loader, and launcher to install the spyware.

Kaspersky’s findings reveal that the payloads are designed for ARM64 and ARM64E architectures and specifically check for A17, M3, M3 Pro, and M3 Max chips.

Additionally, the package IDs and system checks show that the exploits can target:

• iOS < 14.0 beta 7
• iOS < 14.7
• iOS < 16.5 beta 4
• iOS < 16.6 beta 5
• iOS < 17.2

Boris Larin, a lead security researcher at Kaspersky’s Global Research and Analysis Team (GReAT), says the connection to Triangulation was clear after reviewing Coruna’s code.

“Coruna isn’t just a collection of existing exploits; it’s a constantly evolving version of the original Operation Triangulation framework.”

Furthermore, the developers kept updating the framework by adding checks for newer processors (like M3) and iOS versions.

Because Coruna has also been used in financially-motivated campaigns to steal cryptocurrency through fake exchange sites, Larin points out that “what started as a targeted spying tool is now being used more broadly.”

Operation Triangulation was a highly advanced iOS spying campaign which used multiple zero-day exploits to secretly infect iPhones and deploy spyware.

Kaspersky discovered it during internal WiFi network monitoring in June 2023, although the campaign had been active for four years prior.

In late 2023, the same researchers discovered that these attacks exploited undocumented features in Apple chips to bypass hardware security measures.

Another exploit kit, called DarkSword, was recently revealed by researchers at mobile security companies Lookout, iVerify, and Google.

Like Coruna, various threat actors are using DarkSword, seemingly for espionage purposes. However, DarkSword is now publicly available, potentially increasing the risk of cybercriminals using it against iPhones that haven’t been updated.

Apple has released a security bulletin to address these newly found exploit kits, stating that fixes for all identified flaws have been included in security updates for the newest and older iOS versions.