American cyberweapons in the hands of Russia’s GRU: what can we do?

OPENING — DRAMATIZED REENACTMENT

The following scene is played by actors. Inspired by real events and documented security breaches, it reconstructs the events in a narrative form in order to introduce the investigation.

The scene opens in the middle of the interrogation. It is 6 p.m. on April 17, 2026.

— So, Jeremy, you work at an elite cybersecurity company.

— You develop spyware for the special services.

— That’s right, yes. We work with the government.

— Jeremy, it says here in the file that a lone hacker stole 400 gigabytes of secret data from you, including the most recent exploits.

— How did he manage to get past your defenses?

— But this was an unprecedented attack, an extremely sophisticated brute-force operation.

— The report says that they simply entered the administrator password and your password was the word “password”.

— No, no, not just “password”.

— The password began with a capital P and, in place of the letter O, there was also a zero: a special character, capital letters, numbers, full compliance with the company's security standards.

— I did everything according to the rules.

— We did everything according to the regulations, we did everything correctly.

END OF REENACTMENT — TIME FOR THE FACTS

The scene played ends here. We now return to the documented facts, the tools involved and how they actually circulated.

Hello, it’s me again, Jeremy, president of the Belgian Institute of Citizen Cybersecurity. And as many know, I was born and raised right in the heart of Mother Russia, in the city of Moscow. This subject is even more painful for me!

I have news for you that is beyond imagination.

Cyberweapons developed by the American military-industrial complex have quite literally leaked into the hands of Russian intelligence services and Chinese hackers.

They can now enter an Apple device as if they were entering their home, provided that its owner has not yet had time to update it.

I'm talking about Coruna.

It is a set of advanced exploits for iOS that allow you to sneak into a device and bypass all protection mechanisms.

And, to be infected, the user has practically nothing to do.

He does not need to download suspicious programs or enter his login and password somewhere.

All you have to do is go to a site controlled by hackers, and the data from your device goes directly to their servers.

The most surprising thing is that this is not even the only tool of this type that was first created for a state before falling into the hands of ordinary cybercriminals.

This sort of thing happens regularly. So this is precisely what I would like to talk about today.

About Coruna itself and what it can do; other similar tools, such as DarkSword; and, more generally, how programs created to track international terrorists end up in the hands of cyberthieves.

And, while we're at it, can we, ordinary people, protect ourselves somehow?

Well, let's try to understand.

But what is this Coruna you are talking about?

It includes a whole arsenal of exploits for Apple devices, from iOS 13, released in 2019, to iOS 17.2.1, released in December 2023.

It cannot compromise a fully up-to-date device. At least, the version obtained by Google researchers cannot.

It is entirely possible that a Coruna 2.0 is currently circulating somewhere on the network and has already learned how to do so.

But 2023 was just recently, and many people are still using older versions of iOS and don't want to update.

How Coruna works is as follows.

You arrive at a compromised site or service that can masquerade as anything: a news portal, an online store, a small gaming blog, and so on.

And if you have an Apple device, malicious JavaScript code arrives with the page.

It determines which device you are using and which version of iOS is installed on it.

Then it chooses a ready-made exploit chain that suits your case precisely.

Coruna goes through all layers of security.

It escapes from Safari's sandbox, exits the isolated environment in which the browser itself operates, then gains kernel-level access rights and injects itself into one of the system processes.

From this moment on, the attacker gains full control of the device and can extract anything that is not pinned to the ground.

Messages, calls, contacts, notes, photographs, videos, iCloud data, browser history, passwords and keyrings, Wi-Fi passwords, geolocation data, and so on.

I could continue this list forever.

In practice, however, attackers are usually interested in cryptocurrency-wallet data. Coruna deploys separate exploits for that purpose.

The entire process, from opening the site to the exfiltration of your data, is absolutely invisible to the user and only takes a few minutes, or even seconds.

Everything I have just told you became public thanks to a report by Google researchers published in March of this year.

They discovered several hundred samples of this tool.

And, thanks to the hackers' negligence, they also managed to get their hands on a debug version.

Someone had used it instead of the final version.

The debug version retained the internal names: that of the Coruna framework itself, but also those of certain exploits.

Interestingly, some were named after birds, for example Sparrow or Cassowary.

Remember this detail, we will need it again.

Some of the exploits relied on known vulnerabilities that had already been patched.

But there were also zero-day vulnerabilities that no one knew existed before.

This set of exploits was apparently created on order from the US military.

Two former employees of a defense contractor confirmed to TechCrunch reporters that Coruna was the internal name for one of the components developed by their Australian division, Trenchant.

Trenchant specializes in hacking tools and sells them to the United States government as well as its closest allies in the Five Eyes alliance: Australia, Canada, New Zealand and the United Kingdom.

It is in this context that the bird names given to exploits become interesting.

Security researcher Costin Raiu says that naming tools after birds is Trenchant’s characteristic signature.

Habits die hard.

Another interesting detail: Coruna is not the first version of this tool.

It has a prehistory.

In 2023, the Kaspersky laboratory discovered that dozens of iPhones belonging to its own employees were infected with advanced spyware.

This attack and the software used during the operation were given the name Operation Triangulation, while the FSB declared that the American NSA was behind the operation.

At least two exploits from the Coruna toolkit had also been used in Triangulation.

This is what emerges from the Google report.

And, at the end of March, the Kaspersky lab analyzed Coruna's code and concluded that the entire framework was a more modern, revamped version of Triangulation.

The link with the Five Eyes is therefore confirmed by several competing sources at the same time: on the Russian side as well as on the American side.

The irony is that the Coruna samples retrieved by Google were used neither by the Americans nor the Australians, but by hackers linked to Russian intelligence who were attacking targets in Ukraine.

Another active user of Coruna was a Chinese hacker group specializing in economic crime.

In other words, hacking tools created for the NSA and the US military leaked into the hands of their main geopolitical adversaries: Russia and China.

It's enough to drive you crazy.

Exactly how this happened is a story in its own right, worthy of a spy novel.

In reality, it is indeed a spy story.

At the origin of the leak was Peter Williams, a former Australian intelligence employee who left to work in the private sector, precisely at Trenchant.

After a while he became general manager.

In 2022, Williams decided his corporate salary wasn't enough to live the good life and contacted Operation Zero, a Russian zero-day vulnerability broker that supplies non-NATO clients, including the Russian government.

Over the next three years, they maintained mutually beneficial cooperation.

Williams took hacking tools developed for Western intelligence services out of Trenchant's offices, and Operation Zero paid him large sums in cryptocurrencies in exchange for these samples.

In total, this great schemer had time to sell $1.3 million worth of exploits.

Following his commercial activities, a US court sentenced him to seven years in prison in February this year.

And Operation Zero founder Sergey Zelenyuk was placed under US sanctions.

But sanctions won't change the weather.

We do not put the ground meat back into the grinder.

Advanced cyberweapons created for Western intelligence services are now in the hands of the FSB and Chinese cybercriminals.

And they use it with pleasure.

My friends, as you watch this episode, the situation in Russia keeps getting worse.

The repression is intensifying, becoming more and more massive and unpredictable.

We see persecution, high-profile criminal cases, torture.

Retirees, women and even minors and children are sentenced to disproportionate sentences and detained in inhumane conditions.

People are prosecuted for any attempt to protest and for expressing their own opinion.

We, the “First Department” human rights project, have been fighting every day since 2021 for every person persecuted by the state.

We defend them in court, support the detainees, provide them with a connection to the outside world, help the families of political prisoners and simply get people out of the country when an opportunity arises.

We are doing everything in our power.

And you too can help.

You, personally.

And your help is really needed.

Thousands of people need our support.

They need lawyers, basic medicines and basic necessities.

Help those who are in misfortune.

Help political prisoners receive legal and humanitarian support, and preserve their lives and human dignity where the state has become an executioner.

Follow the link in the description.

Even a small amount can save someone’s life.

As I already told you at the beginning of the video, the Coruna leak is far from the only case in which intelligence services create cyberweapons that then fall into the hands of God knows who.

What’s more, this isn’t even the only case this year.

Literally two weeks after the Coruna report, the same Google researchers discovered another similar exploit kit, which they called DarkSword.

And this no longer worked on old versions of iOS, but on fairly recent versions, still current in fall 2025.

And even more people are still using them today.

Its functionalities are similar.

The attacks begin on a site belonging to the hackers. Next, DarkSword exits the sandbox and obtains access rights, then vacuums up conversations from all messengers, the contact book, photographs, notes, data from cryptocurrency wallets, and so on.

We don't know exactly who developed all this wonder.

This is likely the work of a commercial hacking tool provider who works with many clients.

But this time, the cyberweapon has not only leaked to Russian hackers, even if they are also actively using it.

No. DarkSword has leaked into the public domain.

It was literally put on GitHub.

This means that anyone can use it.

And when I say “anyone,” I don’t mean just any criminal hacker group.

DarkSword can be used by any specialist who knows how to set up their own server and host a site on it.

And if a language model agrees to help, DarkSword can even be used by a person who has absolutely no technical skills.

According to data from the Apple company itself, at the time of the DarkSword leak, one in four iPhones was running iOS version 18 and could therefore be vulnerable to this kit.

We find ourselves in a situation where literally any cybercriminal has gained the ability to hack hundreds of millions of relatively new Apple devices with virtually no effort.

Whereas previously, only state actors with considerable resources had such a capacity.

This is all very reminiscent of the story of the EternalBlue exploit, which leaked in 2016.

Originally, it was developed by the American NSA, but the hacker group Shadow Brokers managed to steal it, along with other tools from the security services, and promised to sell the whole thing for a million bitcoins.

At the time, that was about half a billion dollars.

Apparently no buyer showed up. So the following year, Shadow Brokers simply published everything it found on the Internet, including EternalBlue.

Hackers from North Korea immediately seized it and created the infamous WannaCry ransomware based on it, which infected 300,000 computers worldwide.

The damage caused by this campaign alone reached four billion dollars.

The funny thing is that a month later, the same exploit was already used by Russian hackers who created NotPetya and attacked Ukrainian government institutions, state-owned enterprises and banks.

All because the NSA obviously doesn't watch our videos and doesn't know how to protect its data.

If they had subscribed to our cybersecurity playlist, there would have been no problem.

Real children, frankly, you have to teach them everything.

If we go back a little further, we can remember the attack on the Italian company Hacking Team.

It was a spyware manufacturer that supplied it perfectly legally to dictators and corrupt officials, who then sold the arsenal to various organized crime groups, including Mexican drug cartels.

In June 2015, a hacker known as Phineas Fisher entered their network and stole 400 gigabytes of data, including several zero-day exploits and their flagship hacking product: Remote Control System.

He then hacked the company's Twitter account and directly posted a link to the stolen source codes there.

I quote:

“Since we have nothing to hide, we are publishing all our correspondence, files and source code.”

Hacking Team was breached through a vulnerability in the SonicWall VPN it was using.

The vulnerability was so easy to exploit that researcher Darren Martyn, who described it, advised SonicWall users to, quote, "unplug it, douse it with kerosene, and set it on fire, because that's the only way to protect yourself from something that was developed with such a level of carelessness."

That said, Hacking Team employees also turned out to be double-digit IQ knights.

Many of them used very simple passwords that were easy to crack with dictionaries.

And one of them actually used the word Password as a password, in which the letter O had been replaced by a zero.

What happened after the leak?

You guessed right.

The hacking tools were immediately adopted by the Fancy Bear group, which works for the Main Directorate of the General Staff, otherwise known as the GRU.

All roads lead to Rome, and all malware ends up in the hands of famous Russian hackers.

In reality, there are still many such stories, and each of them could be the subject of a separate video.

The situation is still the same.

A state or one of its contractors creates a cyberweapon and claims that it will only be used within the law and only against terrorists.

In some cases, they even keep their promise or, at least, they pretend very convincingly.

But then the cyberweapon falls into the hands of those same terrorists, intelligence services of other states, or ordinary online thieves.

Because some genius decided to use the word “password” as a password.

But we're the ones who will have to clean this up, not them.

So let's quickly go through the ways to protect ourselves.

First thing, and the most important.

Updates should be installed regularly on all devices, especially operating system updates.

Exploit development takes a lot of time. This is why they often work precisely on older versions of operating systems, as in the case of Coruna.

The older the version, the more likely it is that someone has found an unpatched vulnerability and invented a way to exploit it.

If you conduct public activities in non-free countries, run or own a large company, store large amounts of cryptocurrencies, or otherwise be of interest to security services and large organized cybercriminal groups, it is a good idea to enable Lockdown Mode on Apple devices.

This is a secure mode.

It severely limits the functionality of the device but radically reduces the attack surface.

Moreover, a similar function recently appeared on Android devices.

For example, Coruna simply ignores phones placed in Lockdown Mode, because it can't do anything about them.

And it wouldn't be bad either not to repeat the mistakes of the Hacking Team people and finally start using normal passwords, impossible to break in a millisecond.

You must therefore choose a long and unique password for each service, then store it in a reliable password manager so that it is neither reused nor stolen.

With that, I say goodbye.