Three Buddy Problem Trenchant, Peter Williams, and the proliferation of a Shadow Brokers-level iOS exploit framework
Mar 6, 2026
They dissect the public spread of a powerful iOS exploit framework and how government-held tools slipped into criminal hands. They trace bird‑named exploit clues suggesting vendor provenance and debate forensic approaches for detection. They also cover rising use of zero-days by surveillance vendors and cybercrime, plus recent cyber‑war activity tied to Iran and Israel.
AI Snips
Chapters
Transcript
Episode notes
Withholding Samples Slows Community Validation
- Google and iVerify observed Coruna in early 2025 but withheld samples; Costin argues that lack of shared IOCs impeded wider analyst validation and hunting.
- The absence of sample uploads to VirusTotal delayed community verification and reconstruction work.
Coruna Relied On Old CVEs With New Bypasses
- Coruna's deployed vulnerabilities were mostly known CVEs from 2020–2024, not fresh zero-days, though some bypasses lacked CVEs.
- That explains wide opportunistic use against older iPhones and why criminal scammers could repurpose the kit quickly.
Scammers Used Coruna On Fake Iran Charity Sites
- Costin found active scam waterholes using Coruna to steal crypto from donors on fake Iranian charity sites.
- These sites lure donations and infect older vulnerable iPhones in the payment flow to exfiltrate wallets.