DarkSword/Coruna Open Directory Finding Report

This report documents the discovery of five open directories exposing the DarkSword/Coruna iOS exploit-and-harvest platform, including a full production C2, wallet-theft modules that extract BIP39 recovery phrases, live beaconing telemetry from infected iOS devices, extensive IOCs (IPs, domains, payload hashes), and an operator profile pointing to a Chinese-speaking commercial exploitation-as-a-service cluster; it also notes development of an iOS 26 JavaScriptCore-based CVE that is not yet fielded.