TechCrunch reveals that the 'Coruna' iPhone-hacking toolkit, used in attacks against Ukrainian and Chinese targets, was likely developed by L3Harris's Trenchant division — a U.S. military contractor. Two former Trenchant employees confirmed Coruna was an internal project. The toolkit appears to have leaked via Peter Williams, a former Trenchant general manager sentenced to seven years in prison for selling eight hacking tools to Russian zero-day broker Operation Zero for $1.3 million. From there, the tools reportedly passed to Russian government spies (UNC6353) who targeted Ukrainians, and eventually to Chinese cybercriminals. Researchers at iVerify and Google also link Coruna exploits to Operation Triangulation, the sophisticated 2023 campaign against Russian iPhone users first exposed by Kaspersky. The chain of custody from a Five Eyes contractor to adversarial nation-state actors and cybercriminals illustrates the risks of offensive cyber tool proliferation.
Sort: