Coruna iOS Kit Reuses 2023 Triangulation Exploit Code in Recent Mass Attacks
Summary: Kaspersky found that the kernel exploit in the Coruna iOS exploit kit is an updated version of the same exploit used in the 2023 Operation Triangulation campaign, built on a shared kernel exploitation framework with common code. Coruna, first documented by Google and iVerify, targets iOS 13.0 through 17.2.1 and contains five full exploit chains and 23 exploits, including CVE-2023-32434 and CVE-2023-38606, with code supporting A17, M3, M3 Pro, and M3 Max processors and checks for iOS 17.2 and iOS 16.5 beta 4.
Bottom line: The kit has moved from a suspected Russia-aligned actor's watering hole attacks in Ukraine to a mass campaign using fake Chinese gambling and cryptocurrency sites to deliver PlasmaLoader, and Kaspersky says the same codebase now carries checks for current Apple silicon - meaning millions of users on unpatched devices are exposed to a tool that began as precision espionage.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2023-32434CVE-2023-38606
- Related
- Apple Issues Security Updates for Older iOS Devices Targeted by Coruna Web Kit Exploit Cyber Risks ·CVE-2023-38606: Apple Multiple Products Kernel Unspecified Vulnerability Known Exploited Vulnerabilities · Jul 26, 2023CVE-2023-32434: Apple Multiple Products Integer Overflow Vulnerability Known Exploited Vulnerabilities · Jun 23, 2023