Development of Coruna iOS exploit kit pinned on US military contractor

TechCrunch reports U.S. military contractor L3Harris' surveillance tech division Trenchant was disclosed by a pair of former employees to have helped in the development of the Coruna exploit kit, which has been used by a Russian state-sponsored threat operation and a Chinese cybercrime group to conduct separate iOS hacking campaigns.

Coruna, which is composed of nearly two dozen components originally used by an unnamed government customer for surveillance operations, was noted by an ex-L3Harris worker to have been used as an internal name for a hacking component.

"Looking at the technical details, so many are familiar," said the ex-employee who referenced a recent report from the Google Threat Intelligence Group. While additional details regarding the transfer of Coruna to adversarial actors remain uncertain, such confirmation from former L3Harris employees comes after former Trenchant General Manager Peter Williams was convicted for peddling the company's hacking tools to Russian firm Operation Zero between 2022 and 2025.