Coruna -- Nation-State-Grade iOS Exploit Kit

Victim visits compromised website
  │
  ▼
Hidden iframe loads Coruna HTML
  │
  ├─→ Fingerprint device (iPhone model + iOS version)
  │
  ├─→ Select appropriate chain (1 of 5)
  │
  └─→ Execute chain:
       Stage 1: WebKit RCE ──→ Code execution in WebContent
       Stage 2: PAC Bypass ──→ Defeat pointer authentication
       Stage 3: Sandbox Escape ──→ Escape WebContent sandbox
       Stage 4: Kernel Exploit ──→ Kernel read/write
       Stage 5: PPL/SPTM Bypass ──→ Full device control
       Stage 6: Payload ──→ PlasmaLoader inject into powerd

1. Construct 306-byte WebAssembly module inline in JavaScript
2. Module compiled → hijack dispatch pointer
3. Wasm sandbox becomes a native function call primitive
4. Swap GOT entries in system frameworks (unsigned!)
5. Trigger legitimate PAC-signed code paths
6. Legitimate code reads attacker's data instead of real data
→ Bypass PAC without forging any signatures

1. Kernel exploit (Gruber) achieves PUAF → physrw primitive
2. But SPTM prevents user pages from becoming kernel/page-table pages
3. Rocket exploits the GFX coprocessor:
   a. GFX coprocessor has DMA access (direct memory access)
   b. IOMMU configuration for GFX has gaps
   c. Exploit GFX to write to page table memory VIA DMA
   d. Create a self-referencing page table entry:
      └─ PTE points to the page table page itself
      └─ Modifying the PTE = modifying the page table itself
      └─ → Arbitrary physical address mapping
4. Full physrw bypassing SPTM!

After full device compromise:
1. Inject into powerd (root-level system daemon)
2. Masquerade as com.apple.assistd (legitimate identifier)
3. Persist across app relaunches (but does not survive reboot)

Capabilities:
  ├── Hook functions in 18+ cryptocurrency wallet apps
  │     (MetaMask, Phantom, BitKeep, Trust Wallet, ...)
  ├── Scan Apple Notes for BIP39 seed phrases
  ├── Scan for keywords: "backup phrase", "bank account", "recovery"
  ├── Intercept clipboard content
  └── Exfiltrate data via C2 server

??? — 2024: Development (English-speaking developer, professional codebase)
Early 2025:  Surveillance vendor sells to state customer → targeted operations
Mid 2025:    UNC6353 (Russia) uses for watering hole attacks on Ukrainian users
Late 2025:   UNC6691 uses fake Chinese finance websites for crypto theft
March 2026:  Google GTIG publishes full analysis

27 exploits organized modularly:
  - Each stage has multiple alternatives
  - Runtime fingerprinting selects the right combination
  - One WebKit bug patched? → swap to an alternative
  → Resilient against individual patches

Instead of:  forging PAC signatures (requires key leak)
Coruna:      tricks legitimate code into running with attacker data
→ An entire class of PAC bypasses that do not need keys

SPTM protects CPU memory access
DMA from coprocessors = separate trust boundary
→ Attack coprocessor's IOMMU → bypass SPTM
→ Future research: GPU, ANE, ISP, DSP as kernel attack vectors

Exploit code has docstrings, comments, English documentation
→ Designed for reuse, maintenance, and handoff
→ Professional software engineering applied to exploitation
→ Raises the bar: exploit development IS software engineering