Coruna, DarkSword & Democratizing Nation-State Exploit Kits

Coruna and DarkSword are advanced iOS exploit kits—derived from tools used in the Operation Triangulation espionage campaign—that have been modified and leaked to criminal and state-linked actors, enabling large-scale credential and cryptocurrency theft by exploiting multiple iOS kernel vulnerabilities (five exploit chains, 23 CVEs); DarkSword was recently posted to GitHub, expanding access to under-resourced cybercriminals and increasing risk to organizations with unpatched devices.