US Military Contractor Likely Built iPhone Hacking Tools Used by Russian Spies in Ukraine A sophisticated hacking campaign targeting iPhone users in Ukraine and China has been linked to tools likely developed by U.S. military contractor L3Harris, according to a report by TechCrunch. The toolkit, known as "Coruna," was initially designed for Western intelligence operations but ended up in the hands of Russian government spies and Chinese cybercriminals. The discovery of Coruna’s use in global attacks was revealed by Google, which identified its components as part of a series of cyber operations spanning 2025. The toolkit, composed of 23 distinct components, was first employed in highly targeted operations by an unnamed government client of a surveillance vendor. It was later used by Russian intelligence agencies to hack Ukrainian targets and later repurposed by Chinese cybercriminals in large-scale campaigns aimed at stealing cryptocurrency and financial data. Mobile cybersecurity firm iVerify, which analyzed Coruna, suggested the toolkit may have originated from a company that sold it to the U.S. government. Two former employees of L3Harris, the parent company of Trenchant—a division specializing in hacking and surveillance tech—confirmed that Coruna was part of Trenchant’s internal projects. They described the toolkit as a component of a broader set of exploits, with technical details aligning with evidence published by Google. The employees, speaking anonymously due to non-disclosure agreements, emphasized that Coruna’s design and functionality were consistent with tools developed by Trenchant. L3Harris exclusively sells Trenchant’s tools to the U.S. government and its Five Eyes allies, including Australia, Canada, New Zealand, and the United Kingdom.#us_military_contractor #l3harris #trenchant #operation_zero #unc6353
