Coruna iOS Exploit Kit Uses 23 Exploits Across Five Chains Targeting iOS 13–17.2.1

Coruna (aka CryptoWaters) is a sophisticated iOS exploit kit composed of five full exploit chains and 23 exploits (affecting iOS 13–17.2.1) that has been observed in the wild since 2025; it has been reused across commercial surveillance, nation-state, and financially motivated actors (clusters UNC6353 and UNC6691) to deliver a stager/implant (PlasmaLoader) that decodes QR images, loads modules, exfiltrates cryptocurrency wallet data, and uses operational techniques such as geofenced delivery, DGA-based C2 fallback, and avoidance of Lockdown Mode.