Back Securityaffairs.Co

Coruna exploit reveals evolution of Triangulation iOS exploitation framework

Securityaffairs.Co •Pierluigi Paganini • March 26, 2026

Kaspersky found Coruna iOS exploits reuse updated code from the 2023 Operation Triangulation attacks, suggesting a possible link. Kaspersky researchers discovered that the Coruna iOS exploit kit uses an updated version of the same kernel exploit seen in the 2023 Operation Triangulation campaign. While early evidence didn’t clearly link the two, the code similarities now […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Coruna Exploit Kit Linked to Operation Triangulation Framework Kaspersky's Global Research and Analysis Team has identified the Coruna exploit kit as an updated version of the Operation Triangulation framework used in a 2023 cyber-espionage campaign. The analysis revealed that one of the five kernel exploits in Coruna is an updated version of a kernel exploit discovered in the original campaign, suggesting a direct link between the two. The remaining four exploits are built on the same framework, indicating that Coruna is a continuously maintained evolution of Triangulation. The kit includes support for Apple's latest processors and checks for recent iOS versions, highlighting the developers' ongoing efforts to adapt the exploit for current systems. Kaspersky urges all iPhone users to install the latest iOS updates, as the vulnerabilities exploited by Coruna have been patched by Apple. However, unpatched devices remain at risk. The original Operation Triangulation campaign targeted iOS devices of Kaspersky employees and exploited four zero-day vulnerabilities affecting a wide range of Apple products. 3 sources 71

Extracted Entities

Coruna exploit reveals evolution of Triangulation iOS exploitation framework

The full story

Extracted Entities

Campaigns (1)

Malware (1)

Platforms (1)