The Google Threat Intelligence Group (GTIG) has discovered an exploit kit targeting Apple iPhone models running iOS 13.0 to 17.2.1, which was used to attack Ukrainian users.
The Google Threat Intelligence Group (GTIG) has discovered an exploit kit targeting Apple iPhone models running iOS 13.0 to 17.2.1, which was used to attack Ukrainian users.
GTIG reported that the developers named the exploit kit Coruna. It contained five full exploit chains for iOS and a total of 23 exploits.
Throughout 2025, GTIG tracked its use in targeted operations, including attacks on Ukrainian users by Russian hackers. It was also used by scammers from China to steal funds.
«In the summer of 2025, we noticed the same JavaScript framework hosted on cdn.uacounter[.]com, a website that loaded as a hidden iFrame on many compromised Ukrainian websites, from industrial equipment and retail tools to local services and e-commerce websites,» the researchers reported.
According to GTIG, the framework was only delivered to specific iPhone users from a specific geographic location. Cyber Researchers
The framework was identical and delivered the same set of exploits. Google cyber researchers alerted the specialized structural unit of the State Security Service CERT-UA about Coruna and worked with it to clean up all compromised websites.
