Threat reportZero-DayTL-2026-0245
DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors (CVE-2026-20700, CVE-2025-43529, CVE-2025-31277)
DarkSword: iOS Exploit Chain Adopted by Multiple Threat (TL-2026-0245), also tracked as DarkSword, is a critical-severity zero-day vulnerability scored CVSS 9.8, first published 2026-03-18 and last reviewed 2026-10-30. It is attributed to UNC6353 (Russia) with high confidence, affects Apple iOS, references 7 CVEs (CVE-2026-20700, CVE-2025-43529, CVE-2025-31277), maps to 54 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 128 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 7Referenced vulnerabilities
- Techniques
- 54MITRE ATT&CK
- Actors
- 3UNC6353
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 128Indicators of compromise
Key facts for TL-2026-0245
- Threat ID
- TL-2026-0245
- Also known as
- DarkSword, DarkSword iOS Exploit Kit
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- ZERO_DAY
- First published
- Last reviewed
- Attribution
- UNC6353, PARS Defense, UNC6748
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia
- Motivation
- ESPIONAGE
- Target sectors
- government, financial, defense, media, judiciary, cryptocurrency, telecommunications, civil-society
- Target regions
- Ukraine, Saudi Arabia, Turkey, Malaysia, Eastern Europe, Middle East, Southeast Asia
- Detection rules
- 9
- Indicators of compromise
- 128
- Updates
- 2026-10-30 · 8 updates · revalidated 7× · latest source
Malware and tooling in DarkSword: iOS Exploit Chain Adopted by Multiple Threat
Malware and tooling: GHOSTBLADE, GHOSTKNIFE, GHOSTSABER, DarkSword File Receiver
How DarkSword: iOS Exploit Chain Adopted by Multiple Threat works
GTIG reports the proliferation of DarkSword, a full iOS exploit chain leveraging six zero-day vulnerabilities now adopted by Russian espionage group UNC6353, Saudi-targeting cluster UNC6748, and Turkish surveillance vendor PARS Defense, deploying GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER malware families to exfiltrate credentials, cryptocurrency wallets, and communications from up to 270 million vulnerable iPhones across Ukraine, Saudi Arabia, Turkey, and Malaysia.
DarkSword is a sophisticated, full iOS exploit chain and infostealer platform that represents a new phase in mobile threats where advanced exploit capabilities originally developed for nation-state espionage are being commoditized and adopted by multiple distinct threat actors for both surveillance and financial gain. The exploit chain targets iPhones running iOS versions 18.4 through 18.7 using a multi-stage attack architecture. For devices running iOS prior to 18.6, DarkSword exploits CVE-2025-31277, a JIT optimization type confusion bug in JavaScriptCore. For devices running iOS 18.6-18.7, it leverages CVE-2025-43529, a use-after-free vulnerability in the Data Flow Graph (DFG) JIT layer of JavaScriptCore. Both WebKit vulnerabilities are chained with CVE-2026-20700, a memory corruption bug in dyld (Dynamic Link Editor) used as a user-mode Pointer Authentication Codes (PAC) bypass to achieve arbitrary code execution. Additional vulnerabilities in the chain include CVE-2025-14174 (out-of-bounds memory access in ANGLE), CVE-2025-43510, and CVE-2025-43520. The attack chain follows a precise sequence: (1) Initial access via watering hole — malicious iframe or script tag injected into compromised legitimate websites loads rce_loader.js from attacker infrastructure; (2) Device fingerprinting — JavaScript identifies the target iOS version and routes to the appropriate exploit module (rce_worker_18.4.js or rce_worker_18.6.js); (3) WebKit exploitation — triggers the appropriate JIT vulnerability for remote code execution; (4) PAC bypass — chains CVE-2026-20700 in dyld to bypass Pointer Authentication Codes; (5) Sandbox escape — uses WebGPU as a pivot point, injecting into mediaplaybackd to break the WebContent sandbox; (6) Privilege escalation — achieves kernel read/write access; (7) Post-exploitation — pe_main.js injects payloads into privileged iOS services including configd, wifid, securityd, UserEventAgent, and Springboard. Three distinct malware families are deployed as final payloads: GHOSTBLADE, a JavaScript dataminer that collects and exfiltrates data over HTTP(S) without persistence or backdoor functionality; GHOSTKNIFE, details of which remain limited; and GHOSTSABER, a JavaScript backdoor with C2 communication, device enumeration, file listing, data exfiltration, and arbitrary JavaScript execution capabilities. DarkSword employs a hit-and-run operational pattern with a dwell time measured in minutes. Data exfiltration targets include: device identifiers, SMS/iMessage, call history, address book, WiFi credentials, Safari history and cookies, location data, photos, calendar, health data, notes, emails, installed applications, saved passwords, and messaging platform data from Telegram and WhatsApp. A significant focus on cryptocurrency theft targets exchanges including Coinbase, Binance, Kraken, Kucoin, Okx, and Mexc, as well as wallets including Ledger, Trezor, Metamask, Exodus, Uniswap, Phantom, and Gnosis Safe. After exfiltration, the malware performs filesystem cleanup and process termination to minimize forensic evidence. GTIG has attributed DarkSword usage to three distinct threat clusters: UNC6353, a Russian-backed espionage group conducting watering hole campaigns against Ukrainian users by compromising Ukrainian government and media websites; UNC6748, which targeted Saudi Arabian users via a Snapchat-themed lure site (snapshare.chat) beginning in early November 2025; and PARS Defense, a Turkish commercial surveillance vendor that deployed DarkSword with improved OPSEC including code obfuscation and ECDH/AES encryption in Turkey (November 2025) and Malaysia (January 2026). The UNC6353 campaign is notable for poor operational security including zero obfuscation of JavaScript/HTML, a server component labeled Dark Sword File Receiver, and evidence of LLM-generated code with detailed comments. The DarkSword campaign is connected to the Coruna iOS exploit kit, which shares command-and-control infrastructure but is operated by entirely separate actors. This proliferation pattern — where the same exploit chain appears across Russian espionage, Turkish commercial surveillance, and Saudi-targeted operations — signals the commoditization of iOS zero-day capabilities through exploit brokers, with potential links to Russian exploit broker Operation Zero (Matrix LLC). iVerify estimates up to 270 million iPhone users running iOS 18 or earlier could be susceptible. Lookout reports approximately 15% of all iOS devices currently in use are vulnerable. All six vulnerabilities were patched by Apple, with most fixed prior to iOS 26.3, which addressed the remaining gaps. Users should update to iOS 18.7.3 or iOS 26.3 or later immediately.
MITRE ATT&CK techniques used in TL-2026-0245
collection
T1005 Data from Local System; T1056 Input Capture; T1113 Screen Capture; T1115 Clipboard Data; T1119 Automated Collection
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1070 Indicator Removal; T1211 Exploitation for Stealth
exfiltration
T1041 Exfiltration Over C2 Channel
execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1204 User Execution
Execution
T1059.007 Command and Scripting Interpreter: JavaScript; T1204.001 User Execution: Malicious Link
privilege-escalation
T1068 Exploitation for Privilege Escalation
Defense Evasion
T1070.004 Indicator Removal: File Deletion; T1480 Execution Guardrails; T1622 Debugger Evasion
command-and-control
T1071 Application Layer Protocol; T1102 Web Service; T1571 Non-Standard Port
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer; T1568.002 Dynamic Resolution: Domain Generation Algorithms; T1573.001 Encrypted Channel: Symmetric Cryptography
discovery
T1082 System Information Discovery; T1518 Software Discovery
Discovery
T1083 File and Directory Discovery
Collection
initial-access
T1189 Drive-by Compromise; T1566 Phishing
Initial Access
T1195.002 Supply Chain Compromise; T1566.002 Phishing: Spearphishing Link
Privilege Escalation
T1404 Exploitation for Privilege Escalation
credential-access
T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Persistence
T1543.004 Create or Modify System Process: Launch Daemon
Credential Access
T1555.001 Credentials from Password Stores: Keychain; T1634.001 Keychain
resource-development
T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1587 Develop Capabilities; T1588 Obtain Capabilities; T1608 Stage Capabilities
Resource Development
T1583.001 Acquire Infrastructure: Domains; T1583.008 Malvertising; T1584.001 Compromise Infrastructure: Domains; T1584.004 Compromise Infrastructure: Server; T1588.005 Obtain Capabilities: Exploits; T1608.004 Stage Capabilities
reconnaissance
Affected products and versions in DarkSword: iOS Exploit Chain Adopted by Multiple Threat
- Apple — iOS
Vulnerable versions: 18.4; 18.4.1; 18.5; 18.5.1; 18.5.2; 18.6; 18.6.1; 18.6.2; 18.7
Fixed in: 18.7.3; 26.3 - Apple — iPadOS
Vulnerable versions: 18.4; 18.5; 18.6; 18.7
Fixed in: 18.7.3; 26.3 - Apple — macOS Tahoe
Vulnerable versions: 26.0; 26.1; 26.2
Fixed in: 26.3 - Apple — Safari
Vulnerable versions: < 26.2
Fixed in: 26.2 - Apple — watchOS
Vulnerable versions: < 26.3
Fixed in: 26.3 - Apple — tvOS
Vulnerable versions: < 26.3
Fixed in: 26.3 - Apple — visionOS
Vulnerable versions: < 26.3
Fixed in: 26.3
Remediation for DarkSword: iOS Exploit Chain Adopted by Multiple Threat
Patches
- Apple iOS 18.7.3 patches CVE-2025-43529 and CVE-2025-31277
- Apple iOS 26.3 patches CVE-2026-20700 and remaining chain vulnerabilities
- Apple macOS Tahoe 26.3 patches CVE-2026-20700
- Apple watchOS 26.3 patches CVE-2026-20700
- Apple tvOS 26.3 patches CVE-2026-20700
- Apple visionOS 26.3 patches CVE-2026-20700
- Apple Safari 26.2 patches CVE-2025-14174 and CVE-2025-43529
Immediate actions
- Update all iOS devices to iOS 18.7.3 or iOS 26.3 or later immediately
- Enable Apple Lockdown Mode on high-risk devices (confirmed to block DarkSword)
- Block known C2 domains at perimeter: cdncounter.net, shapelie.com, snapshare.chat
- Block IP 141.105.130.237 at network perimeter
- Monitor for connections to ports 8881/8882 on external hosts
- Scan network logs for connections to static.cdncounter.net and sqwas.shapelie.com
Workarounds
- Enable Apple Lockdown Mode which is confirmed to stop DarkSword exploit chain
- Avoid browsing Ukrainian government and media websites on unpatched iOS devices
- Use VPN with web filtering to block known malicious domains
- Disable JavaScript in Safari for high-risk browsing sessions
Longer-term hardening
- Deploy mobile threat defense (MTD) solutions with exploit chain detection capability
- Implement mandatory iOS update policies and retire devices unable to receive patches
- Deploy web content filtering to block known watering hole infrastructure
- Establish mobile device management (MDM) policies enforcing minimum iOS versions
- Monitor for anomalous data exfiltration patterns from mobile devices
- Conduct threat hunting for GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER indicators
CVEs associated with DarkSword: iOS Exploit Chain Adopted by Multiple Threat
CVE-2026-20700, CVE-2025-43529, CVE-2025-31277, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520, CVE-2025-24201
Weaknesses (CWE) in DarkSword: iOS Exploit Chain Adopted by Multiple Threat
Timeline of DarkSword: iOS Exploit Chain Adopted by Multiple Threat
Showing the 20 most recent tracked events.
- CISA adds CVE-2025-31277, CVE-2025-43510, and CVE-2025-43520 to the Known Exploited Vulnerabilities catalog, giving FCEB agencies a 21-day remediation deadline.
- Russian FSB-linked TA446 (COLDRIVER/Star Blizzard) launches a spear-phishing campaign using the leaked DarkSword source, spoofing Atlantic Council correspondence and targeting Leonid Volkov, delivering GHOSTBLADE and a new MAYBEROBOT backdoor via password-protected ZIPs.
- Apple expands the iOS 18.7.7 update rollout to additional devices specifically to block DarkSword exploitation; roughly 221 million iPhones (14.2% of active base) remain on vulnerable 18.4-18.6.2 builds.
- Jamf Threat Labs publishes 'DarkSword iOS Exploit Kit: 3 Lessons for Mobile Security,' warning the public source leak lowers the barrier for criminal and opportunistic actors to operationalize the chain against ~221.5 million users still on iOS 18.4-18.6.2.
- As of 2026-05-29, all six DarkSword CVEs are patched (iOS 26.3) and in CISA KEV with FCEB deadlines already passed, validating the PATCHED record. But the kit is still actively wielded by undisrupted actors (UNC6353, UNC6748, PARS Defense) against unpatched iOS 18.4-18.7 iPhones, so it remains active and warrants MONITORING.
- Censys begins identifying infrastructure for a new, previously untracked Chinese-attributed threat-actor campaign reusing the leaked DarkSword and Coruna source, comprising 100+ web properties.
- Censys researcher documents hosting concentrated in Hong Kong reaching into Japan, the US, and Europe; identifies multiple live control panels (DarkSword Admin, Decode Dashboard, C2 Control Panel) and an open directory in Frankfurt exposing a previously undocumented malware family, Thorn C2.
- August 2026: iVerify investigates an infected device belonging to a financial-institution employee and identifies the P7 DarkSword variant.
- The Hacker News publishes the campaign report, disclosing GHOSTBLADE and Thorn C2 deployment via AWS-console and Apple ID sign-in decoys, and the Telegram contact channel t.me/YATA0000 linked to the operator's C2 infrastructure.
- Watering-hole beacon telemetry records two iPhones (iOS 16.3.1 and 16.1) on Chinese networks polling for hours, 4,690 reports in total.
- Old DS-Fusion production server 202.146.222.253 is migrated, per Censys.
- Censys ARC first sees four open-directory hosts exposing DarkSword/Coruna tooling (43.134.165.205, 166.88.95.90, 23.148.212.237, 47.102.192.23).
- 156.239.230.120 first seen exposing the full exploit_server.py FastAPI C2 platform and darksword.db on ports 8080/80.
- Open-directory capture window (2026-09-15 to 09-17) ends: 11 recovery phrases, 179 device loot directories and a 75-account control-plane roster captured; loot is not a verified victim count.
- Censys repository sweep identifies 22 wild-build samples tied to Cloudflare-fronted 66ds.lol.
- Censys publishes the DarkSword/Coruna open-directory finding report; GBHackers covers it on 2026-10-08.
- iVerify discloses the 'P7' DarkSword variant: SpringBoard-resident implant beaconing every 15 seconds, adding iCloud Keychain extraction, crypto wallet recovery-phrase theft (imToken, BitKeep), Photos/Notes theft and a remote command set; reported by The Hacker News.
- iVerify and Report URI publish findings on malicious Instagram ads (World Cup lure via ad-track.live) delivering P7 DarkSword, and the DeadTag operation: 660+ re-registered expired tag/analytics domains exposing ~135M monthly visits, serving Coruna to older iOS and modified P7 DarkSword to iOS 18.4-18.7.
- Press coverage details the half-click Instagram ad infection and iOS-version-based Coruna/P7 targeting; PrestaShop stores reported compromised with DarkSword loaders disguised as analytics code.
- Zimperium zLabs publishes technical report on Coruna and DarkSword: 608 Coruna-family delivery domains (93 matched to 21 tracking servers, rotated within days), art-template npm backdoor, fake jquery.min.js on googleapls.com, and a DarkSword test on iOS 18.6.2 showing 144 C2 contacts, seven additional modules and exfiltration of Telegram storage, Apple Notes and a 214-item app inventory; victims seen in Brazil, Nigeria and Indonesia.
Update history for TL-2026-0245
- 2026-10-30 — Coruna and DarkSword Drive-By iOS Exploit Chains Targeting iPhones for Data Theft (CVE-2022-48503): What changed No severity, exploitability, status or attribution field changes; the record is already CRITICAL / ACTIVE / ACTIVE. New intelligence is additive: infrastructure, artifacts, delivery vectors and observed victim geography. New in
- 2026-10-27 — Malicious Instagram Ads Deliver DarkSword (P7) iOS Spyware via Half-Click Attack; DeadTag Expired-Domain Campaign: What changed No severity/exploitability/status change (already CRITICAL/ACTIVE; the newer report's HIGH rating is not applied as it would be a downgrade). New delivery vector: malicious Instagram ads (ad-track.live) and the DeadTag expired-
- 2026-10-09 — P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands (CVE-2025-24201, CVE-2025-31200): What changed No severity/exploitability/status change (already CRITICAL/ACTIVE). Adds the P7 variant capability set: iCloud Keychain and wallet theft, remote commands (execute_command, wallet_extract, file_upload, sleep, etc.), 15-second C2
- 2026-10-09 — DarkSword iOS Exploit Platform Uses Coruna Malware to Steal Crypto Wallet Recovery Phrases (CVE-2026-31001 in development): What changed No field escalation. Severity (existing CRITICAL vs report HIGH) and status are left unchanged; the report's lower severity is not applied (no downgrades). New indicators (10) 11 new indicators: fallback C2 199.30.90.154:18090,
- 2026-10-08 — Exposed DarkSword iOS Exploit Servers Reveal Crypto Wallet Theft From Compromised iPhones (CVE-2026-31001): What changed No severity/exploitability/status change (already CRITICAL/ACTIVE). Record is extended with Censys's September 2026 open-directory findings: a commercial exploit-as-a-service platform (DS-Fusion) with a FastAPI C2, 19 wallet-in
- 2026-10-01 — tweetfeed.live community intel: New TL_OSINT_Scan community intel: 2 newly-corroborated indicator(s).
- 2026-08-17 — DarkSword iOS Exploit Kit Source Leak Enables One-Click RCE with Full Sandbox Escape on iOS 18.4-18.6.2: What changed No escalation to severity/exploitability/status (all already CRITICAL/ACTIVE/ACTIVE). Two new CWE classifications added (CWE-120 buffer overflow, CWE-667 improper locking) for the XNU kernel bugs. New timeline detail fills a ga
- 2026-08-03 — Chinese Threat Actor Exploits Leaked DarkSword/Coruna iOS Exploit Kits to Deploy GHOSTBLADE and New Thorn C2 Malware: What changed Status MONITORING → ACTIVE: the March 2026 public leak of DarkSword's source code (github.com/ghh-jb/DarkSword) has commoditized the kit, producing a new, large-scale campaign (100+ web properties, multiple live C2 panels as of
Sources cited for DarkSword: iOS Exploit Chain Adopted by Multiple Threat
- GTIG: The Proliferation of DarkSword - iOS Exploit Chain Adopted by Multiple Threat Actors
- Lookout: Attackers Wielding DarkSword Threaten iOS Users
- iVerify: Inside DarkSword - A New iOS Exploit Kit Delivered Via Compromised Legitimate Websites
- CyberScoop: Second iOS exploit kit emerges from suspected Russian hackers
- BleepingComputer: New DarkSword iOS exploit used in infostealer attack on iPhones
- Lookout Press Release: Lookout Uncovers DarkSword iOS Exploit Chain
- iVerify: Second Mass Attack Against iOS Disclosed in Two Weeks
- SOC Prime: CVE-2026-20700 - Apple Patches Zero-Day Exploited in Sophisticated Attacks
- Help Net Security: Apple fixes zero-day flaw (CVE-2026-20700)
- NVD: CVE-2025-43529
- NVD: CVE-2025-14174
- GTIG: Coruna - The Mysterious Journey of a Powerful iOS Exploit Kit
Detection coverage for TL-2026-0245
As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0245 across Splunk SPL, Microsoft KQL and Sigma, covering 128 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.