Coruna and DarkSword: Advanced iOS Exploits Fall into Cybercriminal Hands

Exploit chains are becoming criminal tools

The Coruna and DarkSword iOS exploit chains, initially associated with state-sponsored actors and mercenary surveillance vendors, are now spreading among conventional cybercriminals as well.

iVerify identified approximately 17,000 domains associated with second-generation variants of the two platforms. Deployment can be extremely fast: a complete iOS exploit chain could reportedly be installed in about five minutes.

Infections continued even after the techniques were publicly disclosed. Operators updated the frameworks with improved jailbreak and virtualization detection, stronger encryption, new persistence mechanisms, and implants focused on Telegram.

iVerify and Palo Alto Networks also observed Coruna and DarkSword being used together. Informally dubbed Darkuna, these hybrid variants introduce new process-injection targets, more advanced anti-analysis defenses, and additional implants.

DarkSword exploits multiple Apple system vulnerabilities

DarkSword has been used since November 2025 against iPhones running iOS 18.4–18.7. The campaigns affected Malaysia, Saudi Arabia, Türkiye, and Ukraine, and have been linked to several commercial surveillance vendors and suspected state-sponsored actors.

The chain combines vulnerabilities across the browser, graphics libraries, loader, and kernel:

• CVE-2025-31277 and CVE-2025-43529, involving memory corruption in JavaScriptCore;
• CVE-2026-20700, which bypasses pointer authentication in dyld’s user mode;
• CVE-2025-14174, a memory-corruption vulnerability in ANGLE;
• CVE-2025-43510 and CVE-2025-43520, involving memory management and corruption in the iOS kernel.

The goal is to achieve a complete exploitation chain: remote code execution, sandbox escape, privilege escalation, and payload installation. Apple patched the vulnerabilities exploited by DarkSword in April; the exact patch versions are unknown.

Coruna uses watering holes and injection into system processes

Coruna is an older, more mature platform designed for devices running iOS 13–17.2.1. It includes 23 vulnerabilities organized into five exploit chains, and its development cost has been estimated at $30–40 million.

The toolkit relies on watering-hole attacks: a user visits a compromised website, which attempts to exploit the browser before proceeding with sandbox evasion and privilege escalation.

After compromising a device, Coruna can inject code into legitimate system processes, including power daemon and location daemon. This approach can make it harder to distinguish malicious activity from normal iOS components.

The historical vulnerabilities underlying Coruna were patched by Apple in 2023 and 2024. Not all identifiers or the exact fix versions have been disclosed.

What users and organizations should do

The primary measure is to install all relevant Apple security updates and keep devices up to date. This is especially important for iPhones running versions within the ranges targeted by the two chains.

Organizations should also:

• monitor domains associated with the distribution of second-generation variants;
• look for signs of jailbreaking or unusual virtualization;
• check for unexpected persistence mechanisms;
• analyze code injection into system processes;
• inspect traffic and implants with Telegram-focused functionality.

The availability of complete exploit chains dramatically lowers the expertise required to conduct advanced attacks. The risk is no longer limited to government targets or individuals under targeted surveillance: Coruna, DarkSword, and Darkuna variants could enable remote compromise, surveillance, and the installation of additional malware on a much broader scale.