Coruna — Nation-State-Grade iOS Exploit Kit

Coruna là exploit kit iOS mạnh nhất từng được công khai phân tích. Chứa 23 exploits tổ chức thành 5 full chains, cover iOS 13.0 đến 17.2.1. Được Google GTIG phân tích năm 2025-2026, đáng chú ý vì engineering quality ở cấp nation-state nhưng bị proliferate sang cybercrime.

Overview

Field Detail
Phát hiện bởi Google Threat Intelligence Group (GTIG)
Công bố March 2026
iOS range 13.0 — 17.2.1
Số exploits 23 exploits trong 5 full chains
Delivery Watering hole (hidden iframe, zero-click in browser)
Payload PlasmaLoader → inject vào powerd daemon
Threat actors Surveillance vendor customer → UNC6353 (Russia) → UNC6691 (crypto theft)
Link Kaspersky Chia sẻ code với Operation Triangulation components

Kiến Trúc Tổng Thể

Coruna là self-contained HTML file, embed dưới dạng hidden iframe (zero dimensions). Không cần user interaction — exploit chạy hoàn toàn trong browser bằng JavaScript, hoàn thành trong vài giây.

Victim visits compromised website
  │
  ▼
Hidden iframe loads Coruna HTML
  │
  ├─→ Fingerprint device (iPhone model + iOS version)
  │
  ├─→ Select appropriate chain (1 of 5)
  │
  └─→ Execute chain:
       Stage 1: WebKit RCE ──→ Code execution in WebContent
       Stage 2: PAC Bypass ──→ Defeat pointer authentication
       Stage 3: Sandbox Escape ──→ Escape WebContent sandbox
       Stage 4: Kernel Exploit ──→ Kernel read/write
       Stage 5: PPL/SPTM Bypass ──→ Full device control
       Stage 6: Payload ──→ PlasmaLoader inject vào powerd

23 Exploits — Chi Tiết Từng Category

WebKit RCE (5 exploits)

Ba đường WebKit RCE độc lập, chọn tại runtime:

Codename Target Technique
Buffout macOS Safari NaN-boxing type confusion
Jacurutu macOS fallback JIT structure check elimination + Web Worker retry
Bluebird iOS Safari (older) OfflineAudioContext heap corruption + SVG attribute manipulation
Terrorbird iOS Safari (newer) Variant of Bluebird cho newer WebKit
Cassowary iOS Safari (latest) Additional WebKit entry point

Tất cả converge vào common arbitrary memory read/write primitive trong WebContent process.

PAC Bypass (2 exploits)

Codename Technique
Breezy Confused deputy attack — swap unsigned GOT entries trong Apple system frameworks, trigger legitimate PAC-authenticated call paths đọc attacker-substituted data
Seedbell Variant cho different iOS versions

Kỹ thuật đáng chú ý:

1. Construct 306-byte WebAssembly module inline trong JavaScript
2. Module compiled → hijack dispatch pointer
3. Wasm sandbox trở thành native function call primitive
4. Swap GOT entries trong system frameworks (unsigned!)
5. Trigger legitimate PAC-signed code paths
6. Legitimate code reads attacker's data thay vì real data
→ Bypass PAC without forging any signatures

Tại sao quan trọng: Thay vì forge PAC signatures (khó), Coruna trick legitimate signed code paths dùng attacker data — “confused deputy” approach. Không cần biết PAC keys.

Sandbox Escape (2 exploits)

Codename Technique
IronLoader Exploit system service reachable từ WebContent sandbox
NeuronLoader Alternative sandbox escape path

Kernel Privilege Escalation (5 exploits)

Codename iOS Target Technique
Neutron iOS 13-14 Classic kernel vulnerability
Pendulum iOS 14-15 Different kernel attack vector
Photon iOS 15-16 PUAF-based kernel r/w
Parallax iOS 16 Updated variant
Gruber iOS 17 Latest kernel exploit, PUAF → physrw

PPL / SPTM Bypass (5 exploits)

Codename Target Technique
Quark iOS 13-14 (PPL) PPL logic bug
Gallium iOS 14-15 (PPL) Alternative PPL bypass
Carbone iOS 15-16 (PPL) Updated PPL bypass
Sparrow iOS 16 (PPL) Variant
Rocket iOS 17 (SPTM) GFX coprocessor → self-referencing page table entry → arbitrary physical write

Deep Dive: Rocket (SPTM Bypass)

Đây là phần advanced nhất — bypass SPTM trên iOS 17.

1. Kernel exploit (Gruber) đạt được PUAF → physrw primitive
2. Nhưng SPTM ngăn user pages trở thành kernel/page-table pages
3. Rocket exploit GFX coprocessor:
   a. GFX coprocessor có DMA access (direct memory access)
   b. IOMMU configuration cho GFX có gaps
   c. Exploit GFX để write vào page table memory VIA DMA
   d. Tạo self-referencing page table entry:
      └─ PTE trỏ về chính page table page
      └─ Modifying PTE = modifying page table itself
      └─ → Arbitrary physical address mapping
4. Full physrw bypass SPTM!

Bài học: SPTM chỉ protect CPU-initiated memory access. DMA từ coprocessors (GPU, Neural Engine, …) là separate attack surface.

Payload: PlasmaLoader (PLASMAGRID)

Sau khi full device compromise:
1. Inject vào powerd (root-level system daemon)
2. Masquerade as com.apple.powerd.battery-health (legitimate identifier)
3. Persist across app relaunches (nhưng không survive reboot)

Capabilities:
  ├── Hook functions trong 18+ cryptocurrency wallet apps
  │     (MetaMask, Phantom, BitKeep, Trust Wallet, ...)
  ├── Scan Apple Notes cho BIP39 seed phrases
  ├── Scan cho keywords: "backup phrase", "bank account", "recovery"
  ├── Intercept clipboard content
  └── Exfiltrate data qua C2 server

Proliferation Timeline

??? — 2024: Development (English-speaking developer, professional codebase)
Early 2025:  Surveillance vendor sells to state customer → targeted operations
Mid 2025:    UNC6353 (Russia) uses for watering hole attacks on Ukrainian users
Late 2025:   UNC6691 uses fake Chinese finance websites for crypto theft
March 2026:  Google GTIG publishes full analysis

Proliferation pattern: Spy tool → state espionage → organized crime. Exploit kits “trickle down” từ nation-state to cybercriminals.

Mối Liên Hệ Với Operation Triangulation

Kaspersky phân tích cho thấy Coruna shares code components với Operation Triangulation:

  • Cùng style MMIO-based PPL bypass
  • Tương tự kỹ thuật kernel exploitation
  • Có thể cùng vendor/developer hoặc shared exploit marketplace

Bài Học Kỹ Thuật

1. Modular Exploit Architecture

23 exploits tổ chức modular:
  - Mỗi stage có multiple alternatives
  - Runtime fingerprinting chọn đúng combination
  - Một WebKit bug bị patch? → swap sang alternative
  → Resilient against individual patches

2. PAC Bypass via Confused Deputy

Thay vì:  forge PAC signatures (cần key leak)
Coruna:   trick legitimate code chạy với attacker data
→ Entire class of PAC bypasses không cần biết keys

3. Coprocessor as SPTM Bypass

SPTM protects CPU memory access
DMA từ coprocessors = separate trust boundary
→ Attack coprocessor's IOMMU → bypass SPTM
→ Future research: GPU, ANE, ISP, DSP as kernel attack vectors

4. Documentation Quality

Exploit code có docstrings, comments, English documentation
→ Designed for reuse, maintenance, and handoff
→ Professional software engineering applied to exploitation
→ Raises the bar: exploit development IS software engineering

Tài Nguyên