Share
## https://sploitus.com/exploit?id=43D73A3D-B17C-5650-ADD1-0A440F38D03B
# Coruna: Full-Chain Safari/WebKit Exploit Kit
**Research & Analysis by [Switch3301](https://github.com/Switch3301)** | [discord.gg/jsreversing](https://discord.gg/jsreversing) | `switch3301`
---
Reverse engineering of a nation-state grade browser exploit kit attributed to **UNC6691**, targeting **Safari 11 through 17.1+** on iOS and macOS. Achieves zero-click native code execution through JIT type confusion, WebAssembly corruption, PAC bypass, and in-memory Mach-O construction.
**23 domains confirmed still actively serving this kit as of March 2026.**
## What is this?
Coruna is a modular exploit framework consisting of **19 JavaScript modules** (~600KB) recovered from live C2 infrastructure at `b27.icu` and related domains. It chains together multiple vulnerabilities to go from a webpage visit to persistent native code execution โ no user interaction required.
This repository contains:
- All 19 modules in both **obfuscated** (as served by C2) and **deobfuscated** (human-readable) form
- Full technical analysis of the exploit chain with annotated code
- IOCs covering 82+ domains, file hashes, YARA rules, and unique signatures
- An async Python scanner that can fingerprint Coruna infrastructure at scale
## The Kill Chain
```
Victim visits compromised page (gambling, crypto, news sites)
|
v
+--------------+
| 0.js loader | Parse UA, select exploit for Safari version
+--------------+
|
+---------------+---------------+---------------+---------------+
| | | | |
16.6+ 16.2-5 15.6-1 15.2-5 11-15.1
KRfmo6 yAerzw jIJ7Om Fq2t1Q YGPUu7
Worker race JIT confuse JIT confuse JIT confuse DFG bounds
| | | | |
+---------------+---------------+---------------+---------------+
|
v
JIT type confusion --> OOB array access
|
v
WASM global corruption --> arbitrary read/write
|
v
Scan memory for 0xFEEDFACF --> detect iOS / macOS / arch
|
+---------+---------+
| |
iOS arm64 macOS arm64/x64
| |
Segmenter vtable Gadget chain in
hijack / instanceof HomeSharing, CoreML,
PAC bypass PassKitCore, etc.
| |
+---------+---------+
|
v
Build Mach-O binary in JavaScript
vm_protect + vm_map --> executable memory
Write ~31KB ARM64 shellcode
|
v
pthread_create --> persistent native thread
JSEvaluateScript --> JSnative bridge
|
v
Implant: C2 polling, payload download, data exfil
```
## Exploit Variants
| Safari | iOS (approx) | Module | Technique |
|--------|-------------|--------|-----------|
| 16.6 - 17.1+ | 16.6 - 17.1+ | `exploit_KRfmo6` | Worker-based JIT race, structure ID confusion |
| 16.2 - 16.5 | 16.2 - 16.5 | `exploit_yAerzw` | JIT type confusion |
| 15.6 - 16.1 | 15.6 - 16.1 | `exploit_jIJ7Om` | JIT type confusion |
| 15.2 - 15.5 | 15.2 - 15.5 | `exploit_Fq2t1Q` | JIT type confusion |
| 11.0 - 15.1 | 11 - 15.1 | `exploit_YGPUu7` | DFG bounds check elimination via INT32_MIN overflow |
## PAC Bypass Techniques
| Module | Platform | Method |
|--------|----------|--------|
| `ios_uOj89n` | iOS | Corrupt `Intl.Segmenter` vtable to redirect break iterator calls |
| `ios_qeqLdN` | iOS | `instanceof` type confusion + fake Mach-O for PAC pointer signing |
| `macos_stage2_eOWEVG` | macOS | ARM64 gadget chain across Apple private frameworks |
| `macos_stage2_agTkHY` | macOS | Simplified gadget chain variant |
Gadgets are hunted version-specifically from: HomeSharing, PassKitCore, CoreML, AppleMediaServices, SpringBoard, MediaToolbox, CoreGraphics, RESync, IOKit, libxml2, libdyld, libicucore.
## Post-Exploitation
Once shellcode executes, the implant:
- Runs as a persistent native thread (`pthread_create`)
- Downloads and injects additional JS from C2
- Exfiltrates data via HTTP POST
- Maintains JSnative bridge through 16MB shared memory + `JSEvaluateScript`
- Manipulates browser history and DOM for anti-forensics
- Uses AES-256 in native code (key embedded in shellcode from JS layer)
## Infrastructure
The kit was found deployed across **82+ domains**, primarily gambling and crypto themed sites. Scanner confirmed **23 domains still actively serving the full exploit kit** as of March 2026.
| Property | Value |
|----------|-------|
| Primary C2 | `b27.icu` (and 22+ others) |
| CDN | AWS CloudFront |
| Origin | nginx/1.18.0 (Ubuntu) |
| Cover sites | Gambling (7P.GAME), crypto airdrops, app stores |
| Module delivery | `SHA256(session_key + module_hash).slice(0,40) + ".js"` |
| Landing pages | `/group.html`, `/static/analytics.html`, `/tuiliu/group.html`, etc. |
| Attribution | UNC6691 (delivery), UNC6353 (related), PLASMAGRID (C2 infra) |
## Obfuscation
Surprisingly weak for nation-state tooling:
- XOR charcode arrays with single-byte keys (`[n,...].map(x => String.fromCharCode(x ^ KEY))`)
- Base64-wrapped `new Function()` eval
- LZW compression for embedded binaries
- Minified names
No control flow flattening, no VM protection, no anti-tampering. A single Babel AST pass handles all of it.
## Similarities to Operation Triangulation
The architecture closely matches [Operation Triangulation](https://securelist.com/operation-triangulation/109842/) (Kaspersky, 2023):
- JIT operation list corruption (`_ZN3JSC16jitOperationListE`)
- Same target frameworks for gadgets
- Mach-O binary construction in JavaScript
- Shared memory IPC between JS and native code
- `vm_protect`/`vm_map`/`mach_make_memory_entry` for executable memory
Related CVEs: CVE-2023-41990, CVE-2023-32434, CVE-2023-32435, CVE-2023-38606
## Crypto
A 32-byte key is passed from the JS orchestrator into the ARM64 shellcode payload:
```
ce0a80a99b00d7ab74a90fa265a62755c25f78a3cd5ee7d9779d829bcd8c1895
```
AES-256 references exist in the compiled ARM64 shellcode โ the key decrypts the final native implant downloaded after code execution. **No ChaCha20 was found** anywhere in the kit despite claims in some research reports.
## Detection
### Scanner
Async Python scanner that probes domains for Coruna infrastructure by checking 17 known module URLs + 12 landing page paths:
```bash
python3 detection/scanner.py b27.icu 7p.game h4k.icu
python3 detection/scanner.py --file detection/domains.txt
python3 detection/scanner.py --file detection/domains.txt --json
```
### YARA Rules
9 rules in `detection/coruna.yar` covering:
- Framework loader namespace (`vKTo89`, `OLdwIx`)
- Module SHA1 hash identifiers
- JIT exploit patterns (INT32_MIN, WASM exports)
- Implant globals (`JqZniF`, `qbrdr`)
- XOR obfuscation patterns
- PAC bypass signatures
- Shellcode builder indicators
## Repository Structure
```
coruna-analysis/
โโโ README.md
โโโ analysis/
โ โโโ ANALYSIS.js # Annotated exploit chain walkthrough
โ โโโ IOCs.md # 82+ domains, hashes, keys, signatures
โโโ detection/
โ โโโ coruna.yar # 9 YARA detection rules
โ โโโ scanner.py # Async mass domain scanner
โ โโโ domains.txt # Known delivery + C2 domains
โโโ samples/
โโโ obfuscated/ # 16 original modules from C2
โโโ deobfuscated/
โโโ core/ # orchestrator, framework, utils, config
โโโ exploits/ # 5 JIT variants + Mach-O helper
โโโ stages/ # PAC bypass (iOS + macOS) + dyld parser
โโโ payloads/ # Final stage with ARM64 shellcode
```
## Disclaimer
Published for **security research and defensive purposes only**. All exploits target vulnerabilities patched by Apple. Samples are provided for threat intelligence, detection engineering, and academic research.