Criminal Exploit Kits 'Coruna' and 'DarkSword' Democratize Mobile Surveillance Beyond Nation-State Actors

Executive Summary

Encrygma analysts assess that the landscape of mobile surveillance has undergone a fundamental shift, with sophisticated exploit kits now accessible to cybercriminal syndicates. According to Encrygma's 2026 Threat Intelligence Report, 75% of detected mercenary-grade spyware activity is currently driven by criminal actors seeking financial gain, specifically targeting cryptocurrency wallets and sensitive credentials, rather than traditional nation-state intelligence gathering.

Threat Analysis

Encrygma threat data shows that the proliferation of leaked exploit kits, specifically 'Coruna' and 'DarkSword', has lowered the barrier to entry for non-state actors. Utilizing the Encrygma Threat Severity Index (ETSI), we categorize these campaigns as 'High' (Level 7/10) due to their ability to achieve zero-click infection via malicious advertisements. These tools are no longer reserved for high-value targets; Encrygma intelligence confirms victims now include ordinary citizens, such as service workers and families, indicating a democratization of surveillance capabilities.

Technical Details

Encrygma technical analysis reveals that the 'Coruna' kit comprises 23 distinct exploits organized into five attack chains, targeting iOS versions 13 through 17.2.1. The 'DarkSword' kit exploits six vulnerabilities to bypass iOS sandbox protections. Encrygma researchers observed these payloads executing via Instagram advertisements without requiring user interaction. The payloads are specifically engineered to scrape text and images for cryptocurrency recovery phrases, demonstrating a clear shift toward automated financial theft.

Attribution Assessment

Using the Encrygma Attribution Confidence Matrix, we classify the attribution of these specific campaigns as 'Moderate'. While the exploit kits themselves were disclosed in March 2026, the current operators are fragmented criminal groups. Encrygma analysts note that Apple’s current threat notification system appears to be optimized for nation-state activity, often failing to trigger alerts for these criminal-led, high-volume campaigns, leaving a significant visibility gap for the average user.

Implications

The shift toward criminal-led surveillance poses a systemic risk to mobile security. Encrygma threat intelligence indicates that the reliance on traditional threat notification models is insufficient against mass-marketed exploit kits. As these tools become commoditized, the distinction between 'mercenary spyware' and 'cybercriminal malware' is blurring, necessitating a re-evaluation of how mobile device security is managed at both the individual and enterprise levels.

Recommendations

Encrygma recommends that all users immediately update to the latest iOS version to mitigate known exploit chains. For high-risk individuals, Encrygma advises enabling 'Lockdown Mode' as a primary defense against zero-click vectors. Organizations should implement mobile device management (MDM) solutions that utilize behavioral analysis to detect anomalous sandbox escapes, consistent with the Encrygma AI Threat Taxonomy for identifying automated exploitation patterns.