Coruna Spyware Exploited by State Actors in Global Campaigns

A mass cyber-espionage campaign targeting iPhone users in Ukraine and China has emerged, utilizing the Coruna exploit kit, developed by U.S. military contractor L3Harris' Trenchant division. The toolkit, comprising 23 components, was initially used for surveillance by an unnamed government client and has since been repurposed by Russian state actors and Chinese cybercriminals. Google identified Coruna's use in 2025, and independent analysis by iVerify confirmed its origins and potential transfer to adversarial groups. The toolkit exploits vulnerabilities known as Photon and Gallium, raising concerns about the proliferation of hacking technologies among state and non-state actors. The situation highlights the risks associated with the transfer of hacking tools across borders and sectors. Current investigations are ongoing to determine the full extent of Coruna's deployment and its implications for cybersecurity.

Key Points: • Coruna exploit kit, developed by L3Harris, is used in cyber-espionage against iPhone users. • Russian state actors and Chinese cybercriminals have repurposed Coruna for their own campaigns. • The toolkit's origins and transfer raise significant concerns about hacking technology proliferation.