# Government Hacking Tools Leaked, Used by Cybercriminals to Compromise iPhones

In a shocking turn of events, security researchers have identified a suite of powerful hacking tools capable of compromising iPhones running older software. These tools, dubbed Coruna, were initially used by a government customer but have since been leaked into the hands of cybercriminals.

Google was the first to detect the exploit kit in February 2025, while attempting to hack into someone's phone with spyware on behalf of a government customer. However, it wasn't until months later that Google identified the same exploit kit targeting Ukrainian users in a broad-scale campaign by a Russian espionage group. The Coruna exploit kit was also later found to be used by a financially motivated hacker in China.

The discovery highlights how exploits and backdoors designed for use by governments can leak into the hands of cybercriminals or other non-state actors. Mobile security company iVerify obtained and reverse-engineered the hacking tools, linking them to the US government due to similarities with previously attributed hacking tools.

"It's clear that these tools have been widely distributed and are being used by various groups," said iVerify. "The more widespread the use, the more certain a leak will occur."

Google has confirmed that the Coruna kit is extremely powerful, allowing hackers to bypass an iPhone's defenses simply by visiting a malicious website containing the exploit code. The kit can hack into an iPhone in five separate ways, relying on and chaining together 23 separate vulnerabilities.

Affected devices range from iPhone models running iOS 13 up to 17.2.1, which was released in December 2023. The Coruna kit contains components that were previously used in a hacking campaign dubbed Operation Triangulation. Russian cybersecurity firm Kaspersky claimed in 2023 that the US government tried to hack several iPhones belonging to its employees.

Leaks of hacking tools are rare, but not unheard of. In 2017, the US National Security Agency discovered that tools it had developed to hack into Windows computers worldwide had been stolen. The Windows backdoor, known as EternalBlue, was later published and used by cybercriminals in subsequent attacks, including the 2017 WannaCry ransomware attack.

This recent discovery highlights the importance of securing devices and staying up-to-date with software updates. As security researcher Zack Whittaker notes, "The more widespread the use, the more certain a leak will occur." It's essential for individuals and organizations to take proactive measures to protect themselves from these types of threats.

In conclusion, the leaking of government hacking tools is a stark reminder of the risks associated with nation-state sponsored cyberattacks. As the threat landscape continues to evolve, it's crucial for security professionals and individuals to stay vigilant and adapt their defenses accordingly.