Apple Warns Older iPhones Vulnerable to Coruna, DarkSword Exploit Kit Attacks

Specifically, the Coruna exploit kit targets 23 vulnerabilities across iOS 13 through 17.2.1, while DarkSword has been observed exploiting iOS versions 18.4 to 18.7. Threat actors, including Russian intelligence and Chinese cybercriminals, have deployed these kits in targeted campaigns against users in Ukraine, Saudi Arabia, Turkey, Malaysia, and Chinese cryptocurrency users. Apple has released specific updates for older devices, alongside patches in the latest iOS versions, to block these advanced threats.

To protect against these web-based attacks, Apple urges users to update their devices to iOS 15.8.7, iPadOS 15.8.7, iOS 16.7.15, and iPadOS 16.7.15 for older hardware. For devices capable of running the latest software, users should update to iOS 26.3.1 and 18.7.6, which contain comprehensive fixes for all known vulnerabilities exploited by DarkSword and Coruna.

Mass Exploitation: DarkSword and Coruna Emerge

Coruna, identified by SecurityWeek, is particularly potent, incorporating 23 exploits across five iOS versions, ranging from iOS 13 to 17.2.1. Initial reports linked its use to UNC6353 in watering hole attacks targeting Ukraine. However, its effectiveness quickly led to adoption by financially motivated groups, demonstrating a broader commercialization of advanced iOS hacking tools.

DarkSword, a separate but similarly powerful exploit, also targets outdated software. Google researchers observed multiple commercial vendors and suspected state-linked hackers using DarkSword in distinct campaigns against targets in Saudi Arabia, Turkey, and Malaysia. The variant employed by UNC6353 specifically targeted devices running iOS versions 18.4-18.6, while another variant, utilized by UNC6748 and PARS Defense, extended its reach to iOS version 18.7, according to SecurityWeek.

Apple's Urgent Security Directives

The company released special updates for older devices that cannot fully upgrade to the latest iOS versions. Users of these devices should update to iOS 15.8.7, iPadOS 15.8.7, iOS 16.7.15, and iPadOS 16.7.15. For those with devices capable of running more recent software, Apple advises updating to iOS 15 to receive the latest protections, along with an anticipated "Critical Security Update" in the coming days, as reported by The Hacker News.

The most comprehensive protection comes from updating to the very latest platform iterations: iOS versions 26.3.1 and 18.7.6. These updates incorporate patches for all vulnerabilities associated with both Coruna and DarkSword exploit kits. Without these updates, hundreds of millions of devices remain potentially exposed to ongoing attacks.

Update Recommendations

For scenarios where immediate software updates are not an option, Apple suggests enabling Lockdown Mode, if available. This feature reduces the attack surface, offering a layer of protection against malicious web content and other threats by restricting certain functionalities.

Geopolitical Targets and Broader Implications

The discovery of DarkSword and Coruna signals a worrying trend: powerful mobile exploitation tools, once reserved for elite state-sponsored operations, are now accessible to a wider array of threat actors. Spencer Parker, chief product officer at iVerify, stated that "nation-state-grade mobile exploitation is now available for mass attack." This accessibility reduces the technical bar for deploying sophisticated attacks.

Parker added that the exploits' relative simplicity and quick adoption by multiple threat actors across various countries confirm their availability on the secondary market for less sophisticated groups. This represents a new level of scale, making widespread mobile attacks a critical and unavoidable concern for all enterprises and individual users, as these exploits are easy to repurpose and redeploy, potentially infecting unpatched users globally.