What a fucking terrible day/two for sysadmins and related folk. I hope there's never a day like this again (there will be, probably sooner than you'd hope).
We definitely should give the feds a backdoor to all encryption. They can be trusted to keep such things secret and secure!
> be @malwrhunterteam
> on a legendary run on social media
> find silly website
> estrosa-dot-it
> website for italian cosmetics
> legit website, used by the pasta people
> notice something silly on website
> /js/analytics/assets/js/group.html
> look inside
> group.html checks browser agent
> detects iOS version
> loads different files depending on iOS version
> loads 49554fde7424c31c.js
> 49*.js doing lots of crazy stuff
> layers of obfuscation and pointer arithmetic
> lolwtf
> look inside
> exact match of Coruna EK
> Coruna Exploit Kit
> Coruna originally used by US government
> rumored to be made by US contractor
> rumored US contractor illegally sold to kremlin
> UNC6353 (kremlin) found using Coruna in 2025
Chat, someone is swinging the legendary goop around. It is Coruna, the state-sponsored iOS exploit kit. All this requires is your Apple device to visit a website and (assuming you're running the targeted iOS version) you're cooked.
Although, from my initial bonking of it, it appears this delivers two different payloads depending on the iOS version. Unfortunately, I know almost nothing about iOS exploitation and iOS malware, so I have no idea what I'm doing. I encouraged my peers and colleagues to review it. It is good goop.
I've archived the payloads from the compromised domain. The shared link is below.
pic unrelated
Jake retweeted
NEW @citizenlab report We uncovered an Israeli firm using online ads to run vast spy operation
This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads.
45 devices at @AJEnglish confirmed infected
citizenlab.ca/research/how-d…
I genuinely hope that all the SaaS companies die a painful death now. Kind of ironic how they wanted to replace people with AI, and are now suffering the same fate.
The Italians as well. What is going on xitter.cf/autocar/status/2109348…
Is this the most unexpected revival of the year? The divisive Fiat Multipla is back, and now it's a cross between a pick-up and SUV buff.ly/iaAMYQN
Jake retweeted
I’ve had a few people write to ask me to follow up on a (reply!) tweet I wrote that’s gotten a lot of retweets. I considered deleting it just to avoid the headache, but I think that would make people more paranoid. So let me share my thoughts.
These people are unreal, this is bordering on some kind of a mental illness. A machine is not a living being. You care more about a machine than you do about your fellow humans.
This quoted post is unavailable.
