# PARS Defense

> As of 2026-10-14, PARS Defense is a threat actor tracked by Threadlinqs Intelligence across 2 threats spanning malware, zero day. ATT&CK coverage spans 50 techniques across 13 tactics in 2 of 2 tracked threats. Most-observed techniques: T1005 (Data from Local System), T1027 (Obfuscated Files or Information), T1041 (Exfiltration Over C2 Channel).

- **Tracked threats:** 2
- **Categories:** MALWARE, ZERO_DAY
- **As of:** 2026-10-14

## ATT&CK techniques observed

50 techniques observed across 2 of 2 tracked threats. Tactics: Command and Control (8), Resource Development (8), Stealth (formerly Defense Evasion) (7), Collection (6), Execution (5), Credential Access (4).

- [T1005](https://intel.threadlinqs.com/technique/T1005) Data from Local System — Collection — observed in 2 of 2 tracked threats
- [T1027](https://intel.threadlinqs.com/technique/T1027) Obfuscated Files or Information — Stealth (formerly Defense Evasion) — observed in 2 of 2 tracked threats
- [T1041](https://intel.threadlinqs.com/technique/T1041) Exfiltration Over C2 Channel — Exfiltration — observed in 2 of 2 tracked threats
- [T1055](https://intel.threadlinqs.com/technique/T1055) Process Injection — Privilege Escalation — observed in 2 of 2 tracked threats
- [T1059.007](https://intel.threadlinqs.com/technique/T1059.007) Command and Scripting Interpreter — Execution — observed in 2 of 2 tracked threats
- [T1068](https://intel.threadlinqs.com/technique/T1068) Exploitation for Privilege Escalation — Privilege Escalation — observed in 2 of 2 tracked threats
- [T1070.004](https://intel.threadlinqs.com/technique/T1070.004) File Deletion — Stealth (formerly Defense Evasion) — observed in 2 of 2 tracked threats
- [T1071.001](https://intel.threadlinqs.com/technique/T1071.001) Application Layer Protocol — Command and Control — observed in 2 of 2 tracked threats
- [T1082](https://intel.threadlinqs.com/technique/T1082) System Information Discovery — Discovery — observed in 2 of 2 tracked threats
- [T1105](https://intel.threadlinqs.com/technique/T1105) Ingress Tool Transfer — Command and Control — observed in 2 of 2 tracked threats
- [T1113](https://intel.threadlinqs.com/technique/T1113) Screen Capture — Collection — observed in 2 of 2 tracked threats
- [T1123](https://intel.threadlinqs.com/technique/T1123) Audio Capture — Collection — observed in 2 of 2 tracked threats
- [T1189](https://intel.threadlinqs.com/technique/T1189) Drive-by Compromise — Initial Access — observed in 2 of 2 tracked threats
- [T1203](https://intel.threadlinqs.com/technique/T1203) Exploitation for Client Execution — Execution — observed in 2 of 2 tracked threats
- [T1555](https://intel.threadlinqs.com/technique/T1555) Credentials from Password Stores — Credential Access — observed in 2 of 2 tracked threats

## Tracked threats

- [Coruna and DarkSword iOS Exploit Kits Compromise iPhones via Single Malicious Website (UNC6353, UNC6691, UNC6748, PARS Defense)](https://intel.threadlinqs.com/threat/TL-2026-3470) — HIGH
- [DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors (CVE-2026-20700, CVE-2025-43529, CVE-2025-31277)](https://intel.threadlinqs.com/threat/TL-2026-0245) — CRITICAL

## Related CVEs

19 CVEs referenced by tracked PARS Defense activity.

- [CVE-2026-20700](https://intel.threadlinqs.com/cve/CVE-2026-20700)
- [CVE-2025-43529](https://intel.threadlinqs.com/cve/CVE-2025-43529)
- [CVE-2025-43520](https://intel.threadlinqs.com/cve/CVE-2025-43520)
- [CVE-2025-43510](https://intel.threadlinqs.com/cve/CVE-2025-43510)
- [CVE-2025-31277](https://intel.threadlinqs.com/cve/CVE-2025-31277)
- [CVE-2025-24201](https://intel.threadlinqs.com/cve/CVE-2025-24201)
- [CVE-2025-14174](https://intel.threadlinqs.com/cve/CVE-2025-14174)
- [CVE-2024-23296](https://intel.threadlinqs.com/cve/CVE-2024-23296)
- [CVE-2024-23225](https://intel.threadlinqs.com/cve/CVE-2024-23225)
- [CVE-2024-23222](https://intel.threadlinqs.com/cve/CVE-2024-23222)
- [CVE-2023-43000](https://intel.threadlinqs.com/cve/CVE-2023-43000)
- [CVE-2023-41974](https://intel.threadlinqs.com/cve/CVE-2023-41974)
- [CVE-2023-38606](https://intel.threadlinqs.com/cve/CVE-2023-38606)
- [CVE-2023-32434](https://intel.threadlinqs.com/cve/CVE-2023-32434)
- [CVE-2023-32409](https://intel.threadlinqs.com/cve/CVE-2023-32409)
- [CVE-2022-48503](https://intel.threadlinqs.com/cve/CVE-2022-48503)
- [CVE-2021-30952](https://intel.threadlinqs.com/cve/CVE-2021-30952)
- [CVE-2020-27950](https://intel.threadlinqs.com/cve/CVE-2020-27950)
- [CVE-2020-27932](https://intel.threadlinqs.com/cve/CVE-2020-27932)

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/PARS%20Defense