A recent investigation has revealed that a sophisticated hacking toolkit targeting iPhone users in Ukraine and China likely originated from the U.S. military contractor L3Harris. This toolkit, known as "Coruna," was initially designed for Western intelligence operations but has reportedly fallen into the hands of various hacking groups, including Russian and Chinese cybercriminals.
According to Google, the Coruna toolkit, composed of 23 components, was deployed in a series of global cyberattacks throughout 2025. Originally crafted for targeted operations by a government client, the toolkit's capabilities have now been exploited by Russian spies against select Ukrainians and by Chinese hackers in broader campaigns aimed at financial theft.
Cybersecurity experts at iVerify, who conducted an independent analysis of Coruna, suggest that the toolkit was initially developed by L3Harris and sold to the U.S. government. Two former employees from L3Harris confirmed that Coruna was part of the company's hacking and surveillance technology division, Trenchant.
One former employee stated, "Coruna was definitely an internal name of a component," indicating that the toolkit had been recognized within the company. The technical details of the toolkit align closely with what was previously known about L3Harris's iPhone hacking tools.
L3Harris exclusively markets its Trenchant tools to the U.S. government and its allies, raising questions about how Coruna ended up with unauthorized users. While it's speculated that Coruna was initially utilized by a Five Eyes intelligence agency, the exact pathway to its current users remains unclear.
The Journey of Coruna
The transition of Coruna from a government contractor to a hacking tool for Russian and Chinese groups mirrors previous incidents involving leaked government hacking tools. For instance, former L3Harris manager Peter Williams was recently sentenced for selling hacking tools to a Russian broker, highlighting vulnerabilities in the security of sensitive technologies.
Google's research links two specific exploits from Coruna, named Photon and Gallium, to a hacking campaign against Russian iPhone users known as Operation Triangulation. This operation, first disclosed by Kaspersky in 2023, utilized similar vulnerabilities, suggesting a connection between the two hacking efforts.
Rocky Cole, co-founder of iVerify, noted that the evidence points towards Trenchant and the U.S. government as the original developers of Coruna. He emphasized that the timeline of Coruna's use coincides with the leaks attributed to Williams, further supporting this theory.
As the cybersecurity landscape evolves, the implications of such toolkits being misappropriated could reshape the future of digital security. The ongoing advancements in hacking techniques underscore the need for robust protective measures and international cooperation to safeguard sensitive technologies.
