Coruna-like iOS exploit kit activity

Analysis of network traffic captured on 2026-10-16 identifies activity consistent with a Coruna-like exploit kit targeting iOS devices. The activity involves web-based delivery, leveraging HTML files and specific redirection patterns observed in packet captures. This activity is associated with recent reports regarding Coruna and DarkSword exploit kits.

Impact

Observed traffic indicates potential unauthorized delivery of exploit payloads to iOS devices. While specific CVEs were not disclosed in this traffic analysis, the activity poses a risk of remote code execution or unauthorized device access.

Recommendation

• Inventory iOS devices within the environment and ensure they are updated to the latest security baseline provided by Apple.
• Review network egress logs for traffic patterns associated with known exploit kit redirectors.
• Monitor for anomalous HTTP or HTTPS requests originating from iOS devices to untrusted or newly registered domains.
• Analyze the provided PCAP and HTML artifacts from the source report in an isolated sandbox to identify environment-specific indicators of compromise.