A suite of government hacking tools targeting iPhones is now being used by cybercriminals

From Spyware to Cybercrime: The Alarming Proliferation of iPhone Exploits

A powerful suite of hacking tools, dubbed “Coruna,” is making waves in the cybersecurity world. What’s particularly concerning is its journey – from the hands of a government customer to suspected use by Russian espionage groups and, financially motivated hackers in China. This highlights a growing trend: the commodification of zero-day exploits and the increasing risk of government-grade hacking tools falling into the wrong hands.

The Coruna Exploit Kit: A Deep Dive

Google’s Threat Intelligence Group first identified Coruna in February 2025, initially linked to a surveillance vendor working on behalf of a government. The kit boasts an impressive arsenal – 23 distinct vulnerabilities chained into five full iOS exploit chains. This allows attackers to bypass iPhone security defenses simply by tricking users into visiting a compromised website, a tactic known as a “watering hole” attack. Affected devices run iOS versions 13.0 through 17.2.1.

Security researchers at iVerify have linked components of Coruna to tools previously attributed to the U.S. Government, raising questions about the origin and potential leak of these sophisticated capabilities. While the exact path of proliferation remains unclear, the case underscores the inherent risk of developing and deploying such powerful tools.

A Secondhand Market for Zero-Day Exploits

The Coruna saga isn’t an isolated incident. Google researchers warn of an emerging market for “secondhand” exploits. Once a vulnerability is discovered and exploited by a government or security firm, it can be sold to others, extending its lifespan and increasing the potential for misuse. This creates a dangerous cycle where exploits are repeatedly repurposed and redeployed by different actors.

This trend mirrors past events, such as the 2017 leak of EternalBlue, a hacking tool developed by the U.S. National Security Agency. EternalBlue was later used in the devastating WannaCry ransomware attack, demonstrating the far-reaching consequences of compromised government tools.

The Case of Peter Williams and the Sale of Exploits

The recent case of Peter Williams, former head of L3Harris Trenchant, further illustrates this problem. Williams pleaded guilty to selling eight exploits, capable of compromising millions of devices, to a broker with ties to the Russian government. This highlights the potential for individuals within the cybersecurity industry to profit from the sale of vulnerabilities, regardless of the ethical implications.

Why Are Government Exploits Leaking?

iVerify suggests that the more widely a tool is used, the greater the chance of a leak. Here’s a fundamental challenge for governments and security agencies that rely on offensive cybersecurity capabilities. Maintaining secrecy and control over these tools is becoming increasingly difficult in a complex and interconnected world.

What Does This Mean for iPhone Users?

The most effective defense against these types of attacks is to preserve your iPhone software up to date. The Coruna exploit kit is ineffective against the latest versions of iOS. Apple regularly releases security updates to patch vulnerabilities, so it’s crucial to install them promptly.

Future Trends to Watch

The proliferation of exploit kits like Coruna signals a shift in the cybersecurity landscape. We can expect to see:

• Increased Commodification of Exploits: A growing market for zero-day vulnerabilities, with brokers and marketplaces facilitating the trade of exploits between different actors.
• More Sophisticated Watering Hole Attacks: Attackers will continue to refine their techniques for compromising websites and delivering exploits to unsuspecting users.
• Greater Focus on Supply Chain Security: Vulnerabilities in software supply chains will become increasingly attractive targets for attackers.
• Enhanced Government Regulation: Governments may introduce stricter regulations on the development, sale, and use of offensive cybersecurity tools.

FAQ

Q: What is an exploit kit?
A: A collection of tools and techniques used to exploit vulnerabilities in software, allowing attackers to gain unauthorized access to systems.

Q: What is a zero-day exploit?
A: An exploit that targets a vulnerability that is unknown to the software vendor.

Q: How can I protect myself from these attacks?
A: Keep your software up to date, be cautious about clicking on links from unknown sources, and use a reputable mobile security solution.

Q: Is my iPhone safe if I have the latest iOS version?
A: While updating to the latest iOS version significantly reduces your risk, no system is completely immune to attack. Staying vigilant and practicing good security habits is essential.

What are your thoughts on the increasing commodification of exploits? Share your opinions in the comments below!