Introduction
On March 4, 2026, Google and iVerify published reports about a highly sophisticated exploit kit targeting Apple iPhone devices. According to Google, the exploit kit was first discovered in targeted attacks conducted by a customer of an unnamed surveillance vendor. It was later used by other attackers in watering-hole attacks in Ukraine and in financially motivated attacks in China. Ad...
The strongest version of this narrative underscores the evolving threat landscape where state-sponsored surveillance tools leak into broader criminal ecosystems. The discovery of Coruna—an updated, modular exploit kit—reveals how sophisticated cyber-espionage frameworks can be repurposed for financial gain or geopolitical disruption. The technical analysis is robust, detailing encryption methods, file structures, and exploit chains, which lends credibility to the findings. However, the narrative...