Coruna exploit reveals evolution of Triangulation iOS exploitation framework

Kaspersky analysis finds the Coruna (CryptoWaters) iOS exploit kit reuses and evolves kernel exploit code from the 2023 Operation Triangulation framework, delivering multi-stage, modular exploit chains (affecting iOS 13.0–17.2.1) that have been used by surveillance vendors and other threat actors in both targeted and broad campaigns; the toolkit includes multiple kernel exploits, loaders, and implants, supports many device types, and demonstrates active exploitation and a secondary market for advanced zero-day capabilities.