CISA warns feds to patch iOS flaws exploited in crypto-theft attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered federal agencies to patch three iOS security flaws targeted in cyberespionage and crypto-theft attacks using the Coruna exploit kit. As Google Threat Intelligence Group (GTIG) researchers revealed earlier this week, Coruna uses multiple exploit chains targeting 23 iOS vulnerabilities, many of which were deployed in zero-day attacks. However, the exploits will not work on recent versions of iOS and will be blocked if the target is using private browsing or has enabled Apple's Lockdown Mode anti-spyware protection feature. Coruna provides threat actors with Pointer Authentication Code (PAC) bypass, sandbox escape, and PPL (Page Protection Layer) bypass capabilities, and enables them to gain WebKit remote code execution and escalate permissions to Kernel privileges on vulnerable devices. GTIG observed the exploit kit being used by multiple threat actors last year, including a surveillance vendor customer, a suspected Russian state-backed hacking group (UNC6353), and a financially motivated Chinese threat actor (UNC6691). The latter deployed it on fake gambling and crypto websites and used it to deliver a malware payload designed to steal infected victims' cryptocurrency wallets. Mobile security firm iVerify also said that Coruna is an example of "sophisticated spyware-grade capabilities" that migrated "from commercial surveillance vendors into the hands of nation-state actors and, ultimately, mass-scale cr...