Coruna Exploit Kit: Evolution from Operation Triangulation

On March 4, 2026, Google and iVerify reported the emergence of the Coruna exploit kit, a sophisticated framework targeting Apple iPhone devices running iOS versions 13.0 to 17.2.1. Initially identified in attacks by an unnamed surveillance vendor, Coruna has since been linked to watering-hole attacks in Ukraine and financially motivated intrusions in China. Kaspersky's Global Research and Analysis Team (GReAT) conducted a detailed analysis, revealing that Coruna is an updated version of the exploit framework used in the Operation Triangulation campaign, which targeted iOS devices in 2023.

Coruna exploit reveals evolution of Triangulation iOS exploitation frameworkIs the coruna exploit kit repurposing Operation Triangulation for new iOS attacks?Coruna iOS Kit Reuses 2023 Triangulation Exploit Code in Recent Mass AttacksCoruna iOS exploit framework linked to Operation Triangulation spywareCoruna framework: an exploit kit and ties to Operation Triangulation

The Coruna exploit kit employs a multi-stage attack chain that begins with a stager in Apple's Safari browser. This stager fingerprints the target device and selects appropriate remote code execution (RCE) and pointer authentication code (PAC) exploits based on the browser and system characteristics. It retrieves encrypted payload metadata, including decryption keys and component locations. The payload orchestrates further exploitation by downloading and decrypting additional modules using the ChaCha20 cipher.

Coruna iOS exploit framework linked to Operation Triangulation spyware

Kaspersky's analysis indicates that one of Coruna's kernel exploits is an updated version of the exploit used in Operation Triangulation. This updated exploit incorporates checks for newer Apple processors, including the A17 and M3 series, and iOS versions up to 17.2, reflecting an active evolution of the original framework. Additionally, Coruna includes four other kernel exploits, some developed after the public disclosure of Operation Triangulation, all sharing a common codebase.

Coruna iOS Kit Reuses 2023 Triangulation Exploit Code in Recent Mass AttacksCoruna exploit reveals evolution of Triangulation iOS exploitation frameworkKaspersky identifies Coruna exploit kit as updated version of Operation Triangulation frameworkCoruna iOS exploit framework linked to Operation Triangulation spyware

The modular design of Coruna allows for broad compatibility across various iOS versions and device architectures. This flexibility has raised concerns about its potential for widespread use among cybercriminals. Originally developed for cyber-espionage, the framework is now being adapted for broader malicious activities, placing millions of users with unpatched devices at risk.

Coruna exploit reveals evolution of Triangulation iOS exploitation framework

Kaspersky emphasizes the importance of immediate software updates for iPhone users, as the vulnerabilities exploited by Coruna have been patched by Apple. However, devices that remain unpatched are still vulnerable to attacks leveraging this exploit kit.

Kaspersky identifies Coruna exploit kit as updated version of Operation Triangulation frameworkCoruna iOS Kit Reuses 2023 Triangulation Exploit Code in Recent Mass AttacksCoruna exploit reveals evolution of Triangulation iOS exploitation frameworkCoruna iOS exploit framework linked to Operation Triangulation spyware

While Kaspersky's findings highlight the dangers posed by the Coruna exploit kit, some experts caution that the evidence linking Coruna directly to Operation Triangulation is not definitive. Boris Larin, principal security researcher at Kaspersky GReAT, noted, "When Coruna was first reported, the public evidence wasn't sufficient to link its code to Triangulation — shared vulnerabilities alone don't prove shared authorship." This perspective suggests that while there are strong technical similarities, the exact nature of the relationship between the two frameworks remains a subject of scrutiny.

Kaspersky identifies Coruna exploit kit as updated version of Operation Triangulation framework

Kaspersky urges all iPhone users to install the latest iOS updates immediately to mitigate risks associated with the Coruna exploit kit. They recommend implementing robust cybersecurity measures, including centralized event monitoring and regular updates to operating systems and applications.

Kaspersky identifies Coruna exploit kit as updated version of Operation Triangulation frameworkCoruna iOS Kit Reuses 2023 Triangulation Exploit Code in Recent Mass AttacksCoruna exploit reveals evolution of Triangulation iOS exploitation frameworkCoruna iOS exploit framework linked to Operation Triangulation spyware

• “Coruna is not a patchwork of public exploits; it is a continuously maintained evolution of the original Operation Triangulation framework.” — Boris Larin, Principal Security Researcher, Kaspersky GReAT

Kaspersky identifies Coruna exploit kit as updated version of Operation Triangulation framework

• “Originally developed for cyber-espionage purposes, this framework is now being used by cybercriminals of a broader kind, placing millions of users with unpatched devices at risk.” — Kaspersky GReAT Report

Coruna exploit reveals evolution of Triangulation iOS exploitation framework

The discovery of the Coruna exploit kit underscores the evolving landscape of cyber threats, particularly as advanced tools initially designed for targeted espionage are repurposed for broader malicious use. The implications for user security are significant, necessitating immediate action to protect against potential exploitation.

Coruna iOS Kit Reuses 2023 Triangulation Exploit Code in Recent Mass Attacks