U.S. Contractor's Spyware, Leaked by Insider, Ends Up in Hands of Russian and Chinese Hackers

A powerful toolkit used to hack iPhones worldwide appears to have originated with a U.S. military contractor before being stolen and sold, eventually arming Russian spies and Chinese cybercriminals. The tool, known internally as 'Coruna,' was developed by Trenchant, a division of the defense giant L3Harris, according to two former company employees who spoke on condition of anonymity.

Trenchant's products are sold exclusively to the U.S. government and its closest intelligence allies. Yet last week, Google detailed how Coruna was used in 2025, first by a Russian espionage group targeting Ukrainians, then by Chinese hackers conducting broad financial theft. The path from a secured government vendor to hostile actors points to a damaging insider leak.

That breach likely involves Peter Williams, a former Trenchant manager sentenced last month to seven years in prison. Williams admitted to stealing eight of the company's hacking tools in 2025 and selling them for $1.3 million to Operation Zero, a Russian broker sanctioned by the U.S. for working with the Kremlin. Prosecutors said Williams's betrayal provided tools that could access millions of devices globally.

Researchers at iVerify, who independently analyzed Coruna, note its technical fingerprints match tools described in the Williams case. The timeline also aligns: Coruna targets iPhone models from a period when Williams had access. 'The best explanation based on what's known right now points to Trenchant and the U.S. government being the original developers,' said iVerify co-founder Rocky Cole, a former NSA analyst.

Further clues tie Coruna to 'Operation Triangulation,' a sophisticated campaign discovered in 2023 that hacked Russian iPhones. One former Trenchant employee said colleagues believed zero-day vulnerabilities exposed in that operation were 'ripped out' of a larger project that included Coruna. While public attribution remains cautious, the evidence paints a clear picture of advanced cyberweapons escaping their intended vault.

Source: TechCrunch