nadsec.onlinePublished
Coruna: A Complete Technical Teardown of a State-Grade iOS/macOS Watering-Hole Exploit Chain
By NadSec
Excerpt
Author: @Nadsec | Date: March 2026 | Classification: Threat Intelligence - Public
Abstract
Coruna is a multi-stage, multi-platform exploit chain targeting Apple's Safari/WebKit engine and XNU kernel on ARM64 (arm64e) devices running iOS and macOS. Operated by UNC6691 (GTIG, March 2026), the chain progresses from browser exploitation through kernel compromise to persistent root-level access - parsing Mach-O binaries from JavaScript, scanning system framework memory for ROP/JOP gadgets, bypassing Apple's Pointer Authentication Code…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by nadsec.online on nadsec.online.
Mentioned in the excerpt
On the same topics
- Proxying to Compromise: SonicWall Secure Mobile Access 0-day ExploitationVolexity · Published 17 Jul
- The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat ActorsMandiant (Google) · Published 18 Mar
- Operation Poisoned News: Hong Kong Users Targeted with Mobile Malware via Local News LinksTrend Micro · Added 1 Apr
- Stray Cat, Open Doors: How k0t Wanders Through the Network EdgeGroup-IB · Published 21 Oct
