How America's iPhone Spy Tools Became a Global Security Nightmare

Summary

• The US government's silence on Coruna is confirmed: the NSA declined to comment on Operation Triangulation attribution in 2023, and neither the NSA nor Apple has responded to the new Coruna allegations, per CyberScoop and the article itself.
• The non-response follows standard intelligence agency practice of neither confirming nor denying classified offensive cyber capabilities, but is unusually conspicuous given the technical depth and multi-source credibility of the allegations from Google and iVerify.
• The stakes are concrete and documented: Coruna's criminal deployment alone may have compromised ~42,000 iOS devices, the toolkit exploits 23 iOS vulnerabilities, and it has provably passed through Russian intelligence and Chinese cybercriminal hands.
• A real-world legal precedent — the sentencing of US contractor Trenchant executive Peter Williams for selling tools to Russian zero-day broker Operation Zero — confirms that US government tool leakage to adversaries is not hypothetical, making silence harder to defend on accountability grounds.
• iVerify frames this as 'the EternalBlue moment for mobile malware,' a historically grounded warning: the US was similarly silent about EternalBlue until after it powered WannaCry and NotPetya — suggesting the current silence may precede years of downstream harm rather than prevent it.

The US Government's Silence on Coruna: What We Know and Why It Matters

The observation in the article is accurate and well-supported: the US government has not officially responded to allegations that Coruna originated as a US-developed hacking toolkit, and this silence follows a consistent pattern established with the earlier Operation Triangulation allegations.

### Confirmed Pattern of Non-Response

The NSA specifically declined to comment on allegations that Operation Triangulation — the earlier iPhone hacking campaign whose code components appear in Coruna — was attributed to the US government. Apple similarly did not respond to requests for comment on the Coruna findings. The article itself notes the US government never responded to Russia's 2023 claim that the NSA was behind Operation Triangulation, and now, with Coruna surfacing as a likely derivative or successor toolkit, the same wall of silence has reappeared.

This is not unusual behavior for intelligence agencies. The NSA and affiliated US intelligence bodies operate under a longstanding policy of neither confirming nor denying the existence of specific offensive cyber capabilities — a posture rooted in operational security and legal frameworks governing classified programs. Publicly acknowledging that a tool was US-developed would, in effect, confirm the existence of classified offensive capabilities, potentially expose legal vulnerabilities (particularly under international law), and could complicate ongoing intelligence operations.

### Why the Silence Is Particularly Conspicuous Here

What makes the non-response more striking in this case is the public, multi-source, and technically detailed nature of the allegations. iVerify — whose cofounder Rocky Cole is a former NSA employee — independently reverse-engineered the Coruna toolkit and concluded it "bears similarities to frameworks previously developed by threat actors associated with the U.S. government." Google's Threat Intelligence Group and iVerify released coordinated research connecting Coruna's components to Operation Triangulation. These are not fringe claims; they come from credible, well-resourced security organizations publishing technical evidence.

Furthermore, the national security stakes are unusually high. iVerify estimates the for-profit criminal campaign alone may have compromised approximately 42,000 iOS devices. The toolkit exploits 23 distinct iOS vulnerabilities and has now demonstrably passed through the hands of at least two adversary groups — suspected Russian intelligence operatives and Chinese-speaking cybercriminals. If the tool is of US origin, that represents a catastrophic intelligence failure with real-world victims.

### The Proliferation Problem and Government Accountability

The broader context makes the silence harder to defend on purely operational grounds. The US Treasury has already sanctioned Russian zero-day brokers accused of acquiring and reselling exploits stolen from US defense contractors, and the article notes that Peter Williams, an executive at US contractor Trenchant, was sentenced to seven years in prison for selling hacking tools to Russian zero-day broker Operation Zero between 2022 and 2025. This establishes a documented, prosecuted pipeline through which US government hacking tools have leaked to adversaries — making the "we can't comment on classified programs" posture increasingly untenable as a public accountability matter.

iVerify itself frames this as a systemic failure: the company believes tools originally intended for counter-terrorism purposes have fallen into many hands due to poor government management or the profit motives of tool developers. Google's report warns of an active and growing market for "second hand" zero-day exploits, where criminal actors acquire sophisticated government-grade tools and adapt them for profit.

### The EternalBlue Parallel

iVerify's Cole draws an explicit comparison to EternalBlue, the NSA Windows-hacking tool stolen and leaked in 2017, which subsequently powered the catastrophic WannaCry and NotPetya attacks. The US government was similarly slow and opaque in its public response to EternalBlue's origins. If Coruna follows the same trajectory, the silence now may be followed by years of downstream damage — and eventual, reluctant acknowledgment. The article's framing of this as "the EternalBlue moment for mobile malware" is a well-grounded analogy supported by the documented proliferation chain.

### Bottom Line

The US government's silence is consistent with established intelligence agency practice, but it is also increasingly difficult to justify on public interest grounds given the scale of confirmed harm, the technical credibility of the researchers making the attribution, and the existence of a documented legal case (the Trenchant/Williams prosecution) that confirms the reality of US tool leakage to adversaries. The silence does not mean the allegations are false — it means they remain officially unaddressed while the toolkit continues to circulate.