What do we know about Coruna, the computer virus affecting iPhones?

The Google Threat Intelligence Group has identified an exploit kit targeting iPhones. That is, a cyber tool that exploits weaknesses in operating systems as users surf the net and is capable of targeting iOS systems from version 13, which dates back to September 2019, to 17.21, released in December 2023. It is called Coruna and was apparently developed by the US government.

The discovery of this kit by Google's cyber intelligence team dates back to February 2025, when it was found to have been used by the client of a surveillance company. In July, Coruna was then used by a group of Russian cyber criminals called UNC6353 to attack some Ukrainian sites, and in December by UNC6691, a Chinese entity, on some betting and cryptocurrency sites.

An affair that raises the suspicion that there is a kind of second-hand market for zero-day, i.e. computer viruses capable of exploiting as yet unknown vulnerabilities in operating systems. Vulnerabilities that Apple resolved in January 2024 by releasing iOS version 17.3.

Not only that: iVerify, a mobile security company, issued a statement explaining that it had found in Coruna 'a sophisticated exploit chain developed by a spyware vendor, which iVerify believes bears similarities to frameworks previously developed by actors linked to the US government'.

On infected devices, a malware called Plasmagrid is installed, which not only steals financial information from affected iPhones, but also empties cryptocurrency wallets. As mentioned, on devices with an operating system later than version 17.2, this vulnerability has been fixed. For those who cannot update iOS, the advice is to activate the isolation mode.