Coruna (aka CryptoWaters) is a sophisticated iOS exploit kit featuring five full iOS exploit chains and 23 exploits targeting iOS versions 13.0 to 17.2.1. The framework uses JavaScript to fingerprint devices, determine authenticity, and gather device details including iPhone model and iOS version. It then loads appropriate WebKit remote code execution exploits based on fingerprint data and executes pointer authentication code (PAC) bypasses. The kit includes reusable modules for vulnerability exploitation and uses non-public exploitation techniques and mitigation bypasses. It can deliver PlasmaLoader (PLASMAGRID) stager binary that decodes QR codes from images and runs additional modules to exfiltrate cryptocurrency wallets and sensitive information from apps. The implant uses a domain generation algorithm with 'lazarus' as seed to generate predictable 15-character domains with .xyz TLD and uses Google's public DNS resolver for validation.