Coruna Exploit Kit and DarkSword iOS Full-Chain Proliferation

The proliferation of the Coruna exploit kit and the associated DarkSword full-chain exploit represents a systemic escalation in mobile threat capabilities. Utilizing a sequence of zero-day vulnerabilities, including CVE-2026-21385, DarkSword facilitates WebKit exploitation, kernel-level privilege escalation, and sandbox escapes to achieve total device compromise on iOS. Originally deployed by boutique actors, the kit has transitioned to a commoditized model, enabling multiple global threat groups to conduct unauthorized data exfiltration and maintain persistence on high-value targets. This shift highlights a critical transition toward widely distributed, high-end offensive capabilities targeting modern iOS security mitigations.

• Overview of Coruna and DarkSword

  • DarkSword is a sophisticated iOS full-chain exploit designed to bypass Apple's layered security architecture.
  • The Coruna kit serves as the delivery and management framework, commoditizing high-end exploitation for diverse threat actors.
  • Current intelligence indicates a shift from single-actor deployment to multi-actor proliferation, increasing the overall risk to global targets.

• Technical Vulnerability Mechanics

  • The exploit chain relies on CVE-2026-21385 and associated zero-days to achieve initial execution.
  • Technical execution follows a rigorous path: WebKit vulnerability $\rightarrow$ Kernel privilege escalation $\rightarrow$ Sandbox escape.
  • Delivery is flexible, supporting both zero-click and one-click vectors depending on the Coruna kit configuration.

• Global Proliferation and Impact

  • The transition to a commoditized ecosystem allows diverse, non-state actors to deploy state-level capabilities.
  • Impact is categorized as critical, severely compromising the confidentiality and integrity of targeted iOS devices.
  • Observations show global geographic reach, specifically targeting high-value individuals and organizational leadership.

• Detection and Defensive Posture

  • Defense requires monitoring for anomalous C2 communication protocols and unauthorized modifications to the iOS filesystem.
  • Organizations should prioritize immediate iOS version updates to mitigate the underlying zero-day vulnerabilities.
  • Network-level telemetry is essential to identify DarkSword C2 beacons and unusual outbound mobile traffic.

• Strategic Conclusion

  • The emergence of "exploit-as-a-service" for iOS lowers the barrier for sophisticated cyber-espionage and data theft.
  • The proliferation of DarkSword necessitates a shift toward behavioral-based mobile threat detection over static indicator matching.