Yeah, so basically Mandiant and iVerify released a paper today about this spoopy thingy called "Coruna". Coruna is very, very silly. Mandiant and iVerify discovered SOMEONE (they don't say who) developed some hardcore iOS zero day exploits. It exploited how iOS devices handled visiting websites (WebKit). When an iOS device visited very, very specific websites (which were hacked by ???), the hacked website delivered carefully written Javascript code that would exploit iOS web browsers. When the iOS device visited the website, the very special Javascript code allowed the website to execute code on the iOS device. In other words, if you're using an iPhone, visit hacked website (you have no idea though), spoopy Javascript (you can't see it) does black magic, automatically executes code on your iOS device to perform espionage (spying). Who is "someone"? Per Mandiant, this toolkit was purchased by a company ... but they don't say the company that purchased it ... This is a toolkit (cyber weapon) purchased by an unknown company and was developed by an unknown organization (or company). Interestingly, the code in Coruna has code overlap with Operation Triangulation, an iOS exploit which was targeting the Russian government ... which was attributed to the United States National Security Agency (by Kaspersky in conjunction with the Russian government) Code overlap in iOS exploits of this caliber are not common. It has lead some to speculate the United States government purchased, or developed, iOS exploits to target Russian government officials and now this same company ... or organization ... is back. Note: The United States governments has not commented on Operation Triangulation (they don't confirm or deny). Interestingly, every single compromised website, delivering the super spoopy Javascript that exploited iOS devices was in Ukraine. It was developed to target Ukrainians. The Ukrainian websites that were compromised were industry specific: - Industrial equipment - Retail tools - Ecommerce websites So, people using iOS devices interested in Industrial equipment, retail tools, and visiting specific ecommerce sites, had their iPhones compromised. However, Mandiant noticed in late 2025, there was a shift. Coruna no longer was targeting Ukrainians. It was targeting Chinese cryptocurrency exchanges. Mandiant did more reverse engineering and through a long winded investigation, they discovered Coruna had 23 iOS exploits. They managed to recover the iOS and (based on programming artifacts) "codenames" with each exploit. The exploits have cool and badass names. BuffOut, Jacurutu, BlueBird, TerrorBird, Cassowary, Breezy, Breezy15, SeedBell, SeedBell16_16, SeedBell_17, IronLoader, NeuronLoader, Neutron, Dynamo, Pendulum, Photon, Parallax, Gruber, Quark, Gallium, Carbone, Sparrow, Rocket 23 iOS RCE exploits are expensive to buy. A conservative estimate for this code would be approx. $11,500,000. Is the United States government purchasing and/or developing iOS exploits? Would the United States government target Ukrainians who buy industrial equipment? Why would the United States target cryptocurrency exchanges? Is it even the United States government? Find out next time on Dragon Ball Z