An iPhone-hacking toolkit used by Russian spies likely came from U.S military contractor

A sophisticated iPhone-hacking toolkit called Coruna, used in global cyberattacks across Ukraine and China, was likely developed by L3Harris's hacking division Trenchant, according to two former employees. Originally intended for Western intelligence agencies, the toolkit spread to Russian government hackers and Chinese cybercriminals. The leak is linked to Peter Williams, a former Trenchant general manager sentenced to seven years in prison for selling eight hacking tools to Russian zero-day broker Operation Zero for $1.3 million. Researchers at iVerify and Google connect Coruna to Operation Triangulation, a 2023 campaign targeting Russian iPhone users, with shared exploits named Photon and Gallium. The chain of custody from a Five Eyes contractor to Russian spies to Chinese criminals illustrates the dangers of offensive cyber tools proliferating beyond their intended users.