APT / THREAT GROUP

Coruna

Internal ID: ios.coruna

aliases

Last seen:Mar 17, 2026

Intelligence Profile

According to Google, this is a new and powerful exploit kit targeting Apple iPhone models running iOS version 13.0 (released in September 2019) up to version 17.2.1 (released in December 2023). The exploit kit, named "Coruna" by its developers, contained five full iOS exploit chains and a total of 23 exploits. The core technical value of this exploit kit lies in its comprehensive collection of iOS exploits, with the most advanced ones using non-public exploitation techniques and mitigation bypasses.

Threat Analysis

Coruna is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit

→https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit?linkId=59478481

Quick Facts

TypeAPT / Threat Group

Aliases1

Also Known As

ios.coruna

External Intelligence

Malpedia: ios.coruna

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Coruna