> be malwrhunterteam
> on a legendary run on social media
> find silly website
> estrosa-dot-it
> website for italian cosmetics
> legit website, used by the pasta people
> notice something silly on website
> /js/analytics/assets/js/group.html
> look inside
> group.html checks browser agent
> detects iOS version
> loads different files depending on iOS version
> loads 49554fde7424c31c.js
> 49*.js doing lots of crazy stuff
> layers of obfuscation and pointer arithmetic
> lolwtf
> look inside
> exact match of Coruna EK
> Coruna Exploit Kit
> Coruna originally used by US government
> rumored to be made by US contractor
> rumored US contractor illegally sold to kremlin
> UNC6353 (kremlin) found using Coruna in 2025
Chat, someone is swinging the legendary goop around. It is Coruna, the state-sponsored iOS exploit kit. All this requires is your Apple device to visit a website and (assuming you're running the targeted iOS version) you're cooked.
Although, from my initial bonking of it, it appears this delivers two different payloads depending on the iOS version. Unfortunately, I know almost nothing about iOS exploitation and iOS malware, so I have no idea what I'm doing. I encouraged my peers and colleagues to review it. It is good goop.
I've archived the payloads from the compromised domain. The shared link is below.
pic unrelated
