iPhone Exploit Toolkit Used by Russian Spies Likely Originated from U.S. Contractor

A powerful iPhone exploit toolkit called 'Coruna,' developed by L3Harris/Trenchant, was stolen by an insider and sold to a sanctioned Russian broker; the toolkit—containing 23 modules and reusing zero-day exploits tied to CVE-2023-32434 and CVE-2023-38606—was then used by UNC6353 in targeted watering‑hole attacks against Ukrainian iPhone users and later repurposed by Chinese cybercriminals to steal money and cryptocurrency.