DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors (CVE-2026-20700, CVE-2025-43529, CVE-2025-31277)
DarkSword: iOS Exploit Chain Adopted by Multiple Threat (TL-2026-0245), also tracked as DarkSword, is a critical-severity zero-day vulnerability scored CVSS 9.8, first published 2026-03-18 and last reviewed 2026-08-17. It is attributed to UNC6353 (Russia) with high confidence, affects Apple iOS, references 6 CVEs (CVE-2026-20700, CVE-2025-43529, CVE-2025-31277), maps to 40 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 58 indicators of compromise.
Key facts for TL-2026-0245
- Threat ID
- TL-2026-0245
- Also known as
- DarkSword, DarkSword iOS Exploit Kit
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- ZERO_DAY
- First published
- 2026-03-18
- Last reviewed
- 2026-08-17
- Attribution
- UNC6353
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia
- Motivation
- ESPIONAGE
- Target sectors
- government, financial, defense, media, judiciary, cryptocurrency, telecommunications, civil-society
- Target regions
- Ukraine, Saudi Arabia, Turkey, Malaysia, Eastern Europe, Middle East, Southeast Asia
- Detection rules
- 9
- Indicators of compromise
- 58
- Updates
- 2026-08-17 · 2 updates · revalidated 2× · latest source
Malware and tooling in DarkSword: iOS Exploit Chain Adopted by Multiple Threat
Malware and tooling: GHOSTBLADE, GHOSTKNIFE, GHOSTSABER, DarkSword File Receiver
GTIG reports the proliferation of DarkSword, a full iOS exploit chain leveraging six zero-day vulnerabilities now adopted by Russian espionage group UNC6353, Saudi-targeting cluster UNC6748, and Turkish surveillance vendor PARS Defense, deploying GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER malware families to exfiltrate credentials, cryptocurrency wallets, and communications from up to 270 million vulnerable iPhones across Ukraine, Saudi Arabia, Turkey, and Malaysia.
How DarkSword: iOS Exploit Chain Adopted by Multiple Threat works
DarkSword is a sophisticated, full iOS exploit chain and infostealer platform that represents a new phase in mobile threats where advanced exploit capabilities originally developed for nation-state espionage are being commoditized and adopted by multiple distinct threat actors for both surveillance and financial gain. The exploit chain targets iPhones running iOS versions 18.4 through 18.7 using a multi-stage attack architecture. For devices running iOS prior to 18.6, DarkSword exploits CVE-2025-31277, a JIT optimization type confusion bug in JavaScriptCore. For devices running iOS 18.6-18.7, it leverages CVE-2025-43529, a use-after-free vulnerability in the Data Flow Graph (DFG) JIT layer of JavaScriptCore. Both WebKit vulnerabilities are chained with CVE-2026-20700, a memory corruption bug in dyld (Dynamic Link Editor) used as a user-mode Pointer Authentication Codes (PAC) bypass to achieve arbitrary code execution. Additional vulnerabilities in the chain include CVE-2025-14174 (out-of-bounds memory access in ANGLE), CVE-2025-43510, and CVE-2025-43520. The attack chain follows a precise sequence: (1) Initial access via watering hole — malicious iframe or script tag injected into compromised legitimate websites loads rce_loader.js from attacker infrastructure; (2) Device fingerprinting — JavaScript identifies the target iOS version and routes to the appropriate exploit module (rce_worker_18.4.js or rce_worker_18.6.js); (3) WebKit exploitation — triggers the appropriate JIT vulnerability for remote code execution; (4) PAC bypass — chains CVE-2026-20700 in dyld to bypass Pointer Authentication Codes; (5) Sandbox escape — uses WebGPU as a pivot point, injecting into mediaplaybackd to break the WebContent sandbox; (6) Privilege escalation — achieves kernel read/write access; (7) Post-exploitation — pe_main.js injects payloads into privileged iOS services including configd, wifid, securityd, UserEventAgent, and Springboard. Three distinct malware families are deployed as final payloads: GHOSTBLADE, a JavaScript dataminer that collects and exfiltrates data over HTTP(S) without persistence or backdoor functionality; GHOSTKNIFE, details of which remain limited; and GHOSTSABER, a JavaScript backdoor with C2 communication, device enumeration, file listing, data exfiltration, and arbitrary JavaScript execution capabilities. DarkSword employs a hit-and-run operational pattern with a dwell time measured in minutes. Data exfiltration targets include: device identifiers, SMS/iMessage, call history, address book, WiFi credentials, Safari history and cookies, location data, photos, calendar, health data, notes, emails, installed applications, saved passwords, and messaging platform data from Telegram and WhatsApp. A significant focus on cryptocurrency theft targets exchanges including Coinbase, Binance, Kraken, Kucoin, Okx, and Mexc, as well as wallets including Ledger, Trezor, Metamask, Exodus, Uniswap, Phantom, and Gnosis Safe. After exfiltration, the malware performs filesystem cleanup and process termination to minimize forensic evidence. GTIG has attributed DarkSword usage to three distinct threat clusters: UNC6353, a Russian-backed espionage group conducting watering hole campaigns against Ukrainian users by compromising Ukrainian government and media websites; UNC6748, which targeted Saudi Arabian users via a Snapchat-themed lure site (snapshare.chat) beginning in early November 2025; and PARS Defense, a Turkish commercial surveillance vendor that deployed DarkSword with improved OPSEC including code obfuscation and ECDH/AES encryption in Turkey (November 2025) and Malaysia (January 2026). The UNC6353 campaign is notable for poor operational security including zero obfuscation of JavaScript/HTML, a server component labeled Dark Sword File Receiver, and evidence of LLM-generated code with detailed comments. The DarkSword campaign is connected to the Coruna iOS exploit kit, which shares command-and-control infrastructure but is operated by entirely separate actors. This proliferation pattern — where the same exploit chain appears across Russian espionage, Turkish commercial surveillance, and Saudi-targeted operations — signals the commoditization of iOS zero-day capabilities through exploit brokers, with potential links to Russian exploit broker Operation Zero (Matrix LLC). iVerify estimates up to 270 million iPhone users running iOS 18 or earlier could be susceptible. Lookout reports approximately 15% of all iOS devices currently in use are vulnerable. All six vulnerabilities were patched by Apple, with most fixed prior to iOS 26.3, which addressed the remaining gaps. Users should update to iOS 18.7.3 or iOS 26.3 or later immediately.
MITRE ATT&CK techniques used in TL-2026-0245
collection
T1005 Data from Local System; T1056 Input Capture; T1113 Screen Capture; T1115 Clipboard Data; T1119 Automated Collection
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1070 Indicator Removal; T1211 Exploitation for Stealth
exfiltration
T1041 Exfiltration Over C2 Channel
execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1204 User Execution
Execution
T1059.007 Command and Scripting Interpreter: JavaScript
privilege-escalation
T1068 Exploitation for Privilege Escalation
Defense Evasion
T1070.004 Indicator Removal: File Deletion; T1622 Debugger Evasion
command-and-control
T1071 Application Layer Protocol; T1102 Web Service; T1571 Non-Standard Port
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1573.001 Encrypted Channel: Symmetric Cryptography
discovery
T1082 System Information Discovery; T1518 Software Discovery
Collection
initial-access
T1189 Drive-by Compromise; T1566 Phishing
credential-access
T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Credential Access
T1555.001 Credentials from Password Stores: Keychain
resource-development
T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1587 Develop Capabilities; T1588 Obtain Capabilities; T1608 Stage Capabilities
Resource Development
T1584.004 Compromise Infrastructure: Server; T1588.005 Obtain Capabilities: Exploits
reconnaissance
Affected products and versions in DarkSword: iOS Exploit Chain Adopted by Multiple Threat
- Apple — iOS
Vulnerable versions: 18.4; 18.4.1; 18.5; 18.5.1; 18.5.2; 18.6; 18.6.1; 18.6.2; 18.7
Fixed in: 18.7.3; 26.3 - Apple — iPadOS
Vulnerable versions: 18.4; 18.5; 18.6; 18.7
Fixed in: 18.7.3; 26.3 - Apple — macOS Tahoe
Vulnerable versions: 26.0; 26.1; 26.2
Fixed in: 26.3 - Apple — Safari
Vulnerable versions: < 26.2
Fixed in: 26.2 - Apple — watchOS
Vulnerable versions: < 26.3
Fixed in: 26.3 - Apple — tvOS
Vulnerable versions: < 26.3
Fixed in: 26.3 - Apple — visionOS
Vulnerable versions: < 26.3
Fixed in: 26.3
Remediation for DarkSword: iOS Exploit Chain Adopted by Multiple Threat
Patches
- Apple iOS 18.7.3 patches CVE-2025-43529 and CVE-2025-31277
- Apple iOS 26.3 patches CVE-2026-20700 and remaining chain vulnerabilities
- Apple macOS Tahoe 26.3 patches CVE-2026-20700
- Apple watchOS 26.3 patches CVE-2026-20700
- Apple tvOS 26.3 patches CVE-2026-20700
- Apple visionOS 26.3 patches CVE-2026-20700
- Apple Safari 26.2 patches CVE-2025-14174 and CVE-2025-43529
Immediate actions
- Update all iOS devices to iOS 18.7.3 or iOS 26.3 or later immediately
- Enable Apple Lockdown Mode on high-risk devices (confirmed to block DarkSword)
- Block known C2 domains at perimeter: cdncounter.net, shapelie.com, snapshare.chat
- Block IP 141.105.130.237 at network perimeter
- Monitor for connections to ports 8881/8882 on external hosts
- Scan network logs for connections to static.cdncounter.net and sqwas.shapelie.com
Workarounds
- Enable Apple Lockdown Mode which is confirmed to stop DarkSword exploit chain
- Avoid browsing Ukrainian government and media websites on unpatched iOS devices
- Use VPN with web filtering to block known malicious domains
- Disable JavaScript in Safari for high-risk browsing sessions
Longer-term hardening
- Deploy mobile threat defense (MTD) solutions with exploit chain detection capability
- Implement mandatory iOS update policies and retire devices unable to receive patches
- Deploy web content filtering to block known watering hole infrastructure
- Establish mobile device management (MDM) policies enforcing minimum iOS versions
- Monitor for anomalous data exfiltration patterns from mobile devices
- Conduct threat hunting for GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER indicators
CVEs associated with DarkSword: iOS Exploit Chain Adopted by Multiple Threat
CVE-2026-20700, CVE-2025-43529, CVE-2025-31277, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520
Weaknesses (CWE) in DarkSword: iOS Exploit Chain Adopted by Multiple Threat
CWE-416, CWE-843, CWE-787, CWE-119, CWE-120, CWE-667
Timeline of DarkSword: iOS Exploit Chain Adopted by Multiple Threat
Showing the 20 most recent tracked events.
- Russian-backed espionage group UNC6353 begins watering hole campaign targeting Ukrainian users by compromising government and media websites including novosti.dn.ua and 7aac.gov.ua
- CVE-2025-14174 and CVE-2025-43529 are reported to Apple by Apple SEAR and Google TAG as under active, sophisticated exploitation.
- Apple patches CVE-2025-14174 (ANGLE out-of-bounds write) and CVE-2025-43529 (WebKit use-after-free) after Google TAG disclosure
- Primary C2 infrastructure at IP 141.105.130.237 becomes active, hosting DarkSword File Receiver on ports 8881/8882
- GTIG observes PARS Defense customer deploying DarkSword against targets in Malaysia, indicating further proliferation
- Apple ships iOS/iPadOS 18.7.2 and 26.1, patching the two XNU kernel bugs in the chain: CVE-2025-43510 (copy-on-write) and CVE-2025-43520 (VFS race condition).
- Apple patches CVE-2026-20700 (dyld memory corruption PAC bypass) across iOS 26.3, macOS Tahoe 26.3, watchOS 26.3, tvOS 26.3, and visionOS 26.3
- GTIG publishes report on Coruna iOS exploit kit, revealing shared C2 infrastructure with DarkSword operators and deployment by Chinese cybercriminal group UNC6691
- Last observed activity from primary C2 infrastructure at IP 141.105.130.237
- Lookout publishes threat intelligence report identifying DarkSword hit-and-run technique, cryptocurrency theft focus, and estimating 270 million vulnerable devices
- Google Threat Intelligence Group publishes comprehensive proliferation analysis attributing DarkSword to UNC6353, UNC6748, and PARS Defense with three malware families GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER
- Anonymous GitHub account (ghh-jb) publicly leaks the complete DarkSword exploit-kit source code; GitHub removes the repository within hours but it is already mirrored across underground forums and Telegram.
- CISA adds CVE-2025-31277, CVE-2025-43510, and CVE-2025-43520 to the Known Exploited Vulnerabilities catalog, giving FCEB agencies a 21-day remediation deadline.
- Russian FSB-linked TA446 (COLDRIVER/Star Blizzard) launches a spear-phishing campaign using the leaked DarkSword source, spoofing Atlantic Council correspondence and targeting Leonid Volkov, delivering GHOSTBLADE and a new MAYBEROBOT backdoor via password-protected ZIPs.
- Apple expands the iOS 18.7.7 update rollout to additional devices specifically to block DarkSword exploitation; roughly 221 million iPhones (14.2% of active base) remain on vulnerable 18.4-18.6.2 builds.
- Jamf Threat Labs publishes 'DarkSword iOS Exploit Kit: 3 Lessons for Mobile Security,' warning the public source leak lowers the barrier for criminal and opportunistic actors to operationalize the chain against ~221.5 million users still on iOS 18.4-18.6.2.
- As of 2026-05-29, all six DarkSword CVEs are patched (iOS 26.3) and in CISA KEV with FCEB deadlines already passed, validating the PATCHED record. But the kit is still actively wielded by undisrupted actors (UNC6353, UNC6748, PARS Defense) against unpatched iOS 18.4-18.7 iPhones, so it remains active and warrants MONITORING.
- Censys begins identifying infrastructure for a new, previously untracked Chinese-attributed threat-actor campaign reusing the leaked DarkSword and Coruna source, comprising 100+ web properties.
- Censys researcher documents hosting concentrated in Hong Kong reaching into Japan, the US, and Europe; identifies multiple live control panels (DarkSword Admin, Decode Dashboard, C2 Control Panel) and an open directory in Frankfurt exposing a previously undocumented malware family, Thorn C2.
- The Hacker News publishes the campaign report, disclosing GHOSTBLADE and Thorn C2 deployment via AWS-console and Apple ID sign-in decoys, and the Telegram contact channel t.me/YATA0000 linked to the operator's C2 infrastructure.
Update history for TL-2026-0245
- 2026-08-17 — DarkSword iOS Exploit Kit Source Leak Enables One-Click RCE with Full Sandbox Escape on iOS 18.4-18.6.2: What changed No escalation to severity/exploitability/status (all already CRITICAL/ACTIVE/ACTIVE). Two new CWE classifications added (CWE-120 buffer overflow, CWE-667 improper locking) for the XNU kernel bugs. New timeline detail fills a ga
- 2026-08-03 — Chinese Threat Actor Exploits Leaked DarkSword/Coruna iOS Exploit Kits to Deploy GHOSTBLADE and New Thorn C2 Malware: What changed Status MONITORING → ACTIVE: the March 2026 public leak of DarkSword's source code (github.com/ghh-jb/DarkSword) has commoditized the kit, producing a new, large-scale campaign (100+ web properties, multiple live C2 panels as of
Sources cited for DarkSword: iOS Exploit Chain Adopted by Multiple Threat
- GTIG: The Proliferation of DarkSword - iOS Exploit Chain Adopted by Multiple Threat Actors
- Lookout: Attackers Wielding DarkSword Threaten iOS Users
- iVerify: Inside DarkSword - A New iOS Exploit Kit Delivered Via Compromised Legitimate Websites
- CyberScoop: Second iOS exploit kit emerges from suspected Russian hackers
- BleepingComputer: New DarkSword iOS exploit used in infostealer attack on iPhones
- Lookout Press Release: Lookout Uncovers DarkSword iOS Exploit Chain
- iVerify: Second Mass Attack Against iOS Disclosed in Two Weeks
- SOC Prime: CVE-2026-20700 - Apple Patches Zero-Day Exploited in Sophisticated Attacks
- Help Net Security: Apple fixes zero-day flaw (CVE-2026-20700)
- NVD: CVE-2025-43529
- NVD: CVE-2025-14174
- GTIG: Coruna - The Mysterious Journey of a Powerful iOS Exploit Kit
Threats related to DarkSword: iOS Exploit Chain Adopted by Multiple Threat
- Coruna iOS Exploit Kit — Government-Grade 23-Exploit Arsenal Proliferates from Surveillance Vendor to Russian Espionage and Chinese Cybercriminals Targeting 42K+ Devices
- Coruna iOS Exploit Kit — 23 Exploits Across 5 Chains Targeting iOS 13-17.2.1 (CVE-2021-30952, CVE-2023-41974, CVE-2023-43000 + 20 More)
- Apple Zero-Day CVE-2026-20700: Memory Corruption Enabling Arbitrary Code Execution — Google TAG-Discovered 'Extremely Sophisticated' Targeted Attack
- Google Chrome V8 Zero-Day CVE-2026-11645 Out-of-Bounds Read/Write Exploited in the Wild
- Coruna Exploit Framework — Updated Operation Triangulation iOS Exploit Kit (CVE-2023-32434, CVE-2023-38606)
Detection coverage for TL-2026-0245
As of 2026-08-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0245 across Splunk SPL, Microsoft KQL and Sigma, covering 58 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.