Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit Introduction Google Threat Intelligence Group (GTIG) has identified a new and powerful exploit kit targeting Apple iPhone models running iOS version 13.0 (released in September 2019) up to version 17.2.1 (released in December 2023) . The exploit kit, named “Coruna” by its developers, contained five full iOS exploit chains and a total of 23 exploits. The core technical value of this exploit kit lies in its comprehen…

https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit

sha256:ac426a7b4a6e3bb4b038d05d2216dc39835f7fa0f30caa1b63e6d02c0f50b633

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve12
md50
url60
ipv40
ipv60
sha10
domain119
sha25620
malware_token0
attack_pattern0
threat_actor_token0

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
domain	string.fromcharcode	Open →
domain	cdn.uacounter.com	Open →
domain	3v5w1km5gv.xyz	Open →
domain	com.apple.assistd	Open →
domain	show.html	Open →
domain	com.bitkeep.os	Open →
domain

Malware families

Allowlist token matches only.

None extracted.

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

None extracted.

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports