Coruna Spyware Surfaces in Global Cross Border Campaigns | Ukraine news - #Mezha

A mass cyber-espionage campaign against iPhone users in Ukraine and China used hacking tools that, according to sources, likely originated from the American military contractor L3Harris and later ended up in the hands of various hacking groups.

In 2025, Google detected the use of Coruna – a complex 23-component toolkit – in targeted operations through an unnamed intelligence services vendor; later it was used by Russian state actors against a limited number of Ukrainian users, and subsequently by Chinese cybercriminals in large-scale campaigns to steal funds and cryptocurrencies.

Independent firm iVerify, which analyzed Coruna, noted that the toolkit could have been created by a firm that handed it over to the U.S. government.

Two former L3Harris employees confirmed that Coruna was partially developed by the Trenchant division, which specializes in iPhone hacking and intelligence. Both asked not to be named.

According to sources, Trenchant sells tools exclusively to the U.S. government and Five Eyes allies (Australia, Canada, New Zealand, the United Kingdom, and the United States), so Coruna could move between different clients and countries through a transfer chain, although the exact of development for individual components remains unknown.

After that Coruna ended up in the hands of the Russian hacking group UNC6353, and later – Chinese cybercriminals who used it in wide-scale campaigns. It is also known that the Triangulation operation exploited the same vulnerabilities – Photon and Gallium – as zero-days.

Analysts indicate that Coruna was likely an instrument of international scope, whose subsequent fate underscores the risks of spreading hacking technologies among governments and private sectors through intermediaries and cybercriminals.

Other news you may find interesting: