CISA Adds iOS Vulnerabilities Exploited by Coruna Exploit Kit to KEV List
Coruna iOS Exploit Kit Added to CISA’s KEV List
A recently disclosed iOS exploit kit, known as Coruna, has been added to the US Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) list. The kit contains exploits for 23 vulnerabilities in iOS versions spanning four years, from iOS 13.0 to iOS 17.2.1. However, it is ineffective against the latest versions of Apple’s mobile platform.
Exploit Kit Details
Coruna has been used by multiple threat actors, including a customer of a spyware vendor, a Russian espionage group, and a financially motivated Chinese group. The exploit kit uses a combination of ‘second-hand’ zero-day exploits to fingerprint devices and load the appropriate WebKit remote code execution (RCE) exploit. It then bypasses various platform mitigations and injects a payload into the ‘powerd’ daemon running as root.
The payload targets the victim’s financial information and can also load additional modules for exfiltrating cryptocurrency wallets and sensitive information from multiple applications. Of the 23 security defects targeted by the exploit kit, 12 have been assigned a CVE identifier. All the exploited issues, whether publicly disclosed or not, have been patched.
Affected Vulnerabilities
Nine of the publicly disclosed bugs were previously flagged as exploited, most of them as zero-days. These include:
- CVE-2022-48503
- CVE-2024-23222
- CVE-2023-32409
- CVE-2020-27932
- CVE-2020-27950
- CVE-2023-32434
- CVE-2023-38606
- CVE-2024-23225
- CVE-2024-23296
The remaining three CVEs, namely CVE-2021-30952, CVE-2023-41974, and CVE-2023-43000, had no public reports of exploitation before the Coruna iOS exploit kit was disclosed.
CISA’s Response
CISA has added all three iOS flaws to the KEV catalog, giving federal agencies three weeks to identify and patch vulnerable devices within their environments, as mandated by Binding Operational Directive (BOD) 22-01. While BOD 22-01 only applies to federal agencies, all organizations are advised to prioritize the remediation of bugs in the KEV catalog.
Additional Warnings
In addition to the Coruna exploit kit, CISA also warned that older vulnerabilities in multiple Hikvision and Rockwell products have been exploited in the wild. Organizations are urged to take proactive measures to address these vulnerabilities and prevent potential attacks.
About Author
English