Google identifies Coruna exploit kit targeting iPhones

In February 2025, Google identified the Coruna exploit kit—a collection of software tools used to exploit vulnerabilities—during a surveillance vendor’s attempt to compromise a phone on behalf of a government customer. Google later discovered the same kit targeting Ukrainian users in a campaign by a Russian espionage group, and subsequently found it being used by a financially motivated hacker in China. The kit is capable of hacking into an iPhone five separate ways by relying on and chaining together 23 separate vulnerabilities. The vulnerabilities affect devices running Apple software up to iOS version 17.2.1, which was released in December 2023.

Mobile security company iVerify reverse-engineered the tools and reported “some evidence” linking the Coruna framework to the U.S. government. The kit allows attackers to bypass an iPhone’s defenses through watering hole attacks—a security attack where a user is compromised simply by visiting a malicious website. Warning of the inevitability of such leaks, iVerify noted, “While iVerify has some evidence that this tool is a leaked US government framework, that shouldn’t overshadow the knowledge that these tools will find their way into the wild and will be used unscrupulously by bad actors.” The kit also contains components used in a 2023 hacking campaign known as Operation Triangulation.

The incident highlights an emerging market for secondhand exploits. This pattern mirrors past leaks, such as in 2017 when the U.S. National Security Agency discovered that tools it developed to hack Windows computers worldwide had been stolen, which later fueled the WannaCry ransomware attack. More recently, Peter Williams, the former head of defense contractor L3Harris Trenchant, was sentenced to more than seven years in prison after pleading guilty to stealing and selling eight exploits. Williams sold the exploits to brokers, including at least one South Korean broker, which prosecutors stated were capable of hacking devices worldwide.

Why it matters

The Coruna incident illustrates the systemic risk of government-developed cyberweapons leaking into the private market, where they are weaponized by non-state actors for widespread exploitation. As these tools proliferate, the line between state-sponsored espionage and commercial cybercrime continues to blur.