State-Sponsored iOS Exploit Kit Targets Unpatched Vulnerabilities

Russian state-sponsored attackers have evolved their iOS exploitation capabilities with the Coruna exploit kit, which targets 23 iOS vulnerabilities including recently disclosed CVEs. The threat actors have improved their original Operation Triangulation exploits with better version checking and support for newer iOS versions and Apple processors. This demonstrates how sophisticated attackers continuously adapt their tools to exploit unpatched systems. Millions of users with outdated iOS versions remain vulnerable to these advanced persistent threat campaigns.

Tactical Insight

Immediate actions

Organizations and users must implement rigorous patch management processes to ensure iOS devices receive security updates promptly after release
Mobile device management (MDM) solutions should enforce automatic updates and maintain visibility into device patch levels across the organization
Regular vulnerability assessments should identify unpatched devices, and policies should restrict network access for devices running outdated operating systems

Detection measures

Security teams should monitor threat intelligence feeds to understand which vulnerabilities are being actively exploited and prioritize patching accordingly